> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?

Even if you are keeping updated buying your new fridge every 2 years like the manufacturer wants, that still doesn't guarantee you are out of the woods from this issue. By definition, security patches are retroactive, after it has been made obvious that there has been a security incident.

Would such a thing even be covered by insurance? Or is it negligence for using a product after it might turn into an unstable bomb at any time?

On the other hand, wild that it doesn't revert to some sort of offline backup mode after warranty ends. Or that anyone bought it in the first place (that can't be standard in the industry, right?).

I'd hope what we'll actually see is people finally demanding that appliances with no need of an internet connection don't get connected to the internet!

I would expect a refrigerator to work 20+ years. What does a legacy product even mean this situation?

I mean, you could also argue that the lack of reliance on physical controls caused the incident in part. For example, a City's public works department may have remote access/control for some of their equipment, but they also have a kill switch that removes all connectivity and reverts the system to a default setting. They also have checks in place like "if the unit heater will be overamped, turn it off." This seems like it was caused by a lack of security considerations when making these devices "online". Old tech can work very well for a long time as long as it is modernized correctly.