I think some of the comments here are just responding to the title without thinking a little more about what was needed and the consequences.

There is certainly a good case to be made that remote access to refrigeration management tech is very useful. But putting a custom app up on the open Internet is just about the absolute worst way to do it - this was basically destined to happen. This was critical infrastructure, and at the very least critical infrastructure like this should be behind a VPN or equivalent security layer.