> The question wasn’t why these systems are setup insecurely (which has an obvious answer about cost prioritization).

It’s not obvious to me that the secure approach is measurably more work than the insecure approach. Someone had to go out of their way to add support for remote temperature control.

> Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked.

No one expects a $20 IoT light switch to ship with its own network equipment, but a $600,000 to $1.5M fleet of freezers for a single grocery store can ship with its own network equipment without increasing the cost a single percentage point.

> You yourself are engaging in cost prioritizing without adequate information

I had hoped that was obvious from the question mark in my original post :) I’m asking what information reconciles this “it feels like they went out of their way to make this insecure” security posture. Responding with “they must have information you don’t have or else they wouldn’t have done it that way” is neither helpful nor logical.

I'm a bit shocked about all the uninformed arguments in the comments. Maybe I shouldn't be, because apparently basic infosec is a foreign language even to large supermarket chains and commercial freezer manufacturers. It's 2026, why the hell would you have critical systems exposed to the internet? In.. "normal" industries this wouldn't just be reasons for immediate termination, this would be a civil lawsuit for recklessly endangering company assets. I'm genuinely flabbergasted. And then it happened, AND IT HAPPENED AGAIN AFTER THREE WEEKS. Why did they not pull the plug at the very second they learned about the first incident?

I'm not happy about the attacks, but it sure seems like someone needed a wakeup call.