Not isolating the refrigerator API from the Internet seems very negligent.
The refrigeration business does not really overlap with infosec or IT in general.
It does now.
even worse: it's grocer's negligence
You seem to set great store in your buns; take care, they may go bad
hard to say who’s to blame: stores, installers or the vendor. most of these dashboards sat online for months, only 195 of 1,331 had every fix, and 76% went offline within days of the attack (disconnecting was possible all along, it seems).