Somebody wrote the software that is the interface between the fridge and the internet. And while it would be nice if HVAC technicians would remember to only make this software accessible via VPN, it is in fact possible to write software that is reachable from the internet while still being secure

Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better

Of course its "possible" for it to be secure, but the people involved are not experts.

The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.

Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.

Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.

The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.

Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.

In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.

We're likely dealing with at least 4 companies here, if not more:

contracted programmers <-> fridge equipment maker <-> HVAC sales/service group <-> grocer

3 of the 4 companies could have all said to themselves "Project ships on Monday, no matter what" because who carries the risks for any flaws ? The grocer(s).

IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.