To maintain the power system balance, flexible load resources have been widely employed to provide operating reserves, which is named demand response (DR). The heating, ventilation, and air conditioning (HVAC) loads cover a high percentage of the total power consumption and have a significant regulation potential that deserves further investigation. To dispatch such dispersed HVACs, distributed control techniques are developed in the DR field due to their flexibility and scalability. However, the distributed DR system is vulnerable to potential cyber-attacks, i.e., false data injection (FDI) attacks, which may lead to DR failure. This paper proposes a resilient distributed controller to protect HVACs against FDI attacks. Firstly, an HVAC-based DR system is built by using distributed control to provide operating reserves for the power grid. Then, the adverse effect of FDI attacks is quantified with mathematical derivation. It is found that a small FDI attack can lead to severe power output deviations, which is a lethal problem for DR. On this basis, an FDI attack-resilient distributed controller is designed for HVACs so as to meet the grid's operating reserve requirements even under attacks. Moreover, the convergence of the proposed controller is proved based on the Laplace transform and final value theorem. Finally, case studies validate the effectiveness of the proposed resilient controller.