As I understand it, they had critical infrastructure, open to world+dog, all locked behind... (checks notes)... a username and password.
Lemmy: Why was this shit on the internet?!
Me: Why didn't they simply lock it down after the first hack?!
I get corporate IT, been there, done that. But they could have locked access to a single IP or group of IPs. MFA anyone? How about a VPN between the freezers and home base or no access? These are easy and nearly free fixes given some IT labor.