A system and method are described for preventing security breaches in an IoT system. For example, one embodiment of a system comprises: an Internet of Things (IoT) device comprising a wireless communication module to establish communication with a plurality of IoT hubs over local wireless communication channels; advertising control logic to transmit first advertising beacons to the plurality of IoT hubs of a user indicating that the IoT device is connectable; the advertising control logic to begin transmitting a second advertising beacon to IoT hubs indicating that the IoT device is not connectable if the IoT device establishes a connection with a first IoT hub, the IoT hubs other than the first IoT hub to report the not connectable status of the IoT device to an IoT service; and a connection security module of the IoT service to determine whether the IoT device is connected to any known IoT hub upon receiving the not connectable status from one or more of the IoT hubs; wherein if the connection security module cannot identify a known IoT hub to which the IoT device is connected, then an alert condition is generated.