Fwiw, the first thread I recall was a speculative blog post about commissary freezers for the US military: https://news.ycombinator.com/item?id=49508506
After that were two separate supermarket events, which I think were both linked to the known Danfoss vulnerability (CVE-2025-41450); and most recently a blood bank event.