As I understand it, they had critical infrastructure, open to world+dog, all locked behind… (checks notes)… a username and password.

Lemmy: Why was this shit on the internet?!

Me: Why didn’t they simply lock it down after the first hack?!

I get corporate IT, been there, done that. But they could have locked access to a single IP or group of IPs. MFA anyone? How about a VPN between the freezers and home base or no access? These are easy and nearly free fixes given some IT labor.