Someone did the math. Cost of continual maintenance, versus cost of product loss. They determined it wasnt worth the maintenance cost, and accepted that risk. And that risk manifested.

This happens all the time. Unfortunately, in my experience, most of the risk acceptance happens without even really believing in the cost of the risk, and people just accept everything. it is highly likely someone like that accepted this.

I think it's fair that the price up until now has been mostly zero. On the other hand you can 10+ years of examples on HN of people saying these types of threats with IoT devices and internet connected industrial hardware are not theoretical and it's shocking they weren't being exploited more often.

Sorry, it was a busy day. I was agreeing with everyone else here. The move fast and break things attitude is one we can't afford when building control systems for critical infrastructure. I used to work in big tech, and if I pushed an update that didn't work or wasn't tested properly, the worst thing that could happen was we revert the change and there's a minor inconvenience to a user. If Facebook goes down for an hour, the company loses money, some advertisers get mad, and their users get frustrated. If an industrial Siemens SCADA operation goes down for an hour, the best case is the operation (be it a factory, airport, wastewater plant, etc.) shuts down for an hour. The worst case is people get sick or die.

It sounds dramatic but every update or change to the system rocks the boat and exposes it to a whole new tranche of dangers. So we spend most of our time observing. There's no such thing as a casual QoL update in SCADA.

My in-laws had a family grocery store back in the 60s and 70s. Privately owned and operated, no way they'd have been paying any attention to security concerns like this.

Their only chance would have been if appliance companies wouldn't be dumb enough to put a simple refrigerator on the public internet in the first place.