I think it's more than this. Industrial control system upgrades are serious business and (at least if you're doing them properly) require a lot of planning and consideration. Particularly when the subsystem being replaced is decades old already.
I think the overwhelming majority of people (including on hn) have no understanding of how complex industrial systems are - even as-built, but particularly after decades of evolution. Doing proper engineering in these spaces is expensive.
You can reasonably blame supermarket chains for being insecure, but we certainly aren't currently enabling them (or anybody else) when it comes to fixing these issues.
It's far less work than touching anything on controller side (at most changing some network settings) and requires attacker to at the very least penetrate your network perimeter and snoop around to find it rather than "run nmap on a controller's default port over country's IP range"
In before "but insurance"; yes insurance can in theory mitigate some of this, but I feel like people on HN have no understanding what it's like to deal with a multi-million dollar insurance claim that the insurance company 100% does not want to pay out. The legal battles over such things take years and are on their own incredibly expensive.
It happened once. Did you do the maths here? Can you tell us which one was Kore expensive and what percentage chance there was of this hack happening?
This happens all the time. Unfortunately, in my experience, most of the risk acceptance happens without even really believing in the cost of the risk, and people just accept everything. it is highly likely someone like that accepted this.
Now that we see large scale incidents will there be an actual money value associated with upgrading systems and security for supermarket appliances.
You can use a modern operating system just fine.
It sounds dramatic but every update or change to the system rocks the boat and exposes it to a whole new tranche of dangers. So we spend most of our time observing. There's no such thing as a casual QoL update in SCADA.
Most SCADA systems date from the 1970s and a lot of them don’t really think about network security or even have a concept of it. So, they don’t think about the consequences of connecting it to the Internet for remote access. It’s just a feature they want.
Their only chance would have been if appliance companies wouldn't be dumb enough to put a simple refrigerator on the public internet in the first place.
(I can see the need for remote monitoring, that the freezer actually worked. Controlling the temperature is the issue.)
Intermarché - €44.5bn revenue (2024)
Cooperative U - €28.35bn revenue (2025)
These aren't struggling grocery stores. They are massive businesses collectively running several thousand stores and employing hundreds of thousands of people. They have IT departments.
The post I replied to (currently the top post on the article) is trying to paint a picture of some harried manager of a struggling grocery store having to fire up networking tools, which is ridiculous. A company doing tens of billions in revenue employs or contracts some of the "laptop class" (to use that post's terminology) to do that, regardless of what their profit margin is. They don't get a "shift-work labor class" employee to take a break from stacking shelves and check the firewall config.
This is a very weird thread.
Those systems are not cheap. It's not the case of lacking few hundred bucks to put it between a VPN box.
It is simply just "well, we weren't hacked before, why change?". Back when those were installed that was just not in the field of view and most those people worried about is changing default password.
And there is another case for industrial equipment, even if it is out of support, what you gonna do, trash a machine because of it ? No, it will be running till it falls apart or it will be more cost effective to replace.
> But I'd setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you're part of a chain and it's centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?
You either pay small cost now, or bigger cost when someone finds out. So, yes, really. We live in times where you no longer have to pay $500+ for enterprise grade VPN box, you can do very acceptable security wise solutions on cheap hardware or on literally "any old piece of junk"
Lots of completely out of touch comments
Maybe it's even honestly not related to the attack.
Boeing still took the blame for MAX, when their customers didn't pay for training.
Empire (Sobeys et al) has seen consistent profit margin of ~2% for the last 2 decades.
Loblaws and Metro have higher profit margins at ~3-4% attributable largely to their acquisition of pharmacy brands which function as high margin grocer/convenience storefronts.
About the 2013 Target data breach, https://krebsonsecurity.com/2015/09/inside-target-corp-days-...
Security isn't optional just because margins are low. If eg FedEx decided to disregard security because they only made 3% of the value of the packages they ship in profit, they'd lose most of that business fast. But yes, let's not shame folks for failing to preempt theoretical-yet-unseen threats, if that's what you mean.
At least that's what I got from it.
"The chain wanted to have Internet enabled control and dashboards about their fridges" or something?
You don't get to say you want the perks of being Internet enabled and then turn around and say that protecting against the downsides would cut into your margins too much. Sheesh
Sir, I think you just invented entirely new type of technomarxism. Sunrise, parabellum!
...
As fun as it is, this has nothing to do with laptops and everything to do with someone not implementing Purdue model right.
In high-margin industries, you can give a 3% salary increase and free coffee and snacks, it is a rounding error compared to the 20% yoy increase applied to your multi-billion dollar compensation.
My class-brained friend, margin is what you get after wages, not before.