Why your supermarket's fridge keeps failing the same way

Seven hundred supermarkets discovered simultaneously that their refrigeration systems were compromised — and not because security teams found them first. The breaches triggered equipment fires, spoiled inventory worth millions. Exposed a problem so fundamental it borders on willful blindness: commercial refrigeration units were networked to the internet with factory default passwords still active, making them vulnerable to exactly the attack that disabled the Ukrainian power grid in December 2015.

That 2015 incident became a watershed moment in critical infrastructure security. Ukrainian operators learned the hard way that SCADA devices (the controllers running power plants, water systems, industrial facilities) needed isolation from enterprise networks and mandatory credential changes. It was not obscure knowledge — the breach made international headlines, spawned thousands of security protocols. Prompted every serious power utility to audit their networked legacy systems. The lesson: default credentials on internet-connected controllers equal catastrophe.

Yet retail chains kept deploying refrigeration units exactly as manufacturers shipped them, with unchanged passwords, connected directly to store networks and sometimes the internet. Nobody asked whether the lesson from critical infrastructure applied to commercial cooling. IT procurement teams for retail chains and their refrigeration vendors never spoke to the security researchers who had spent years documenting industrial control system vulnerabilities. Different industries, different threat models, same devices, and same negligence.

The breach wasn't novel. It was repetition. When forensic investigators traced the attack, they found the pathway was not sophisticated: network access, default credentials, lateral movement through SCADA protocols that had never been updated since 2005. The vendor knew the devices were vulnerable. Retailers apparently did not know they needed to check. A civil aviation engineer designing safety systems would catch this mismatch instantly. The principles don't change between domains. The institutional silos do.

This is what institutional amnesia looks like in practice. A lesson learned at catastrophic cost in one sector remains invisible to another sector using identical hardware. Five years of security conferences, breach reports. Remediation protocols somehow created the expectation that critical infrastructure and retail were solving different problems. They were not. The refrigeration unit is the problem. Your supply chain depends on whether someone bothered to change a password.