Before I start, I want to be very clear: I did not mean to do this. I know that's what everyone says. I know that's what the guy who accidentally launched a missile test in Hawaii said. But I genuinely, truly, with every fiber of my being, did not intend to take down the coffee infrastructure of a major metropolitan hospital. And yet.

It was a Tuesday. I was sitting in the waiting room of St. Something-or-Other Medical Center because I'd done something stupid to my wrist — I think I sprained it rage-typing during a code review. The irony of injuring myself with a keyboard is not lost on me. The waiting room had that special hospital smell, the one that's a mix of industrial cleaner and quiet desperation, and I'd been there for about two hours when I got bored enough to start poking at my phone.

The hospital had guest Wi-Fi. Cool. Normal. I connected like a normal person. Then I did what any normal person absolutely does NOT do, which is start casually scanning the network to see what's on it. Look, it's a reflex at this point. Some people bite their nails. Some people scroll Twitter. I enumerate subnets. We all have our coping mechanisms.

The guest network was segmented. Props to whatever IT person set that up. But there was one device that was sitting on BOTH the guest network and what appeared to be an internal IoT VLAN. It had a web interface on port 443. I opened it in my browser expecting to see a printer or maybe a thermostat.

It was a coffee machine.

Not just any coffee machine. A Jura GIGA X8, which if you don't know, is the kind of coffee machine that costs more than my first car. It's the kind of coffee machine that has its own IP address, its own API, and apparently its own existential crisis, because the admin panel was wide open. No password. Not even a default password. Just... open. Like a 24-hour diner for anyone who wandered in.

Now, a responsible person would have closed the browser tab, reported the issue to hospital IT, and gone back to waiting for their name to be called. I want you to know that I fully intended to be that person. I really did. But then I saw the API documentation link at the bottom of the page, and I thought, "I'll just take a quick look."

Famous last words. Right up there with "I'll just have one drink" and "how hard can it be?"

The API was REST-based and genuinely well-documented, which honestly felt like an insult. This coffee machine had better API docs than half the startups I've worked with. There were endpoints for everything: brew strength, temperature, milk foam density, cup size, maintenance schedules. There was even a GET endpoint that returned real-time statistics on how many cups had been brewed. This hospital was averaging 847 cups a day. Eight hundred and forty-seven. I suddenly understood why doctors always look like that.

I poked around for maybe ten minutes. Harmless stuff. Read-only. Just looking. Like window shopping, except the window was a REST API and the shop was a medical facility's caffeine supply chain.

Then I found the firmware update endpoint.

It accepted a POST request with a binary payload. No authentication. No checksum validation. No nothing. Just "send me bytes and I'll execute them." This coffee machine had the security posture of a screen door on a submarine. I was horrified. I was fascinated. I was going to leave it alone.

I did not leave it alone.

In my defense, I only sent a tiny request. A harmless little ping to the firmware endpoint with an empty payload, just to see what would happen. What happened was: nothing. For about four seconds. Then the coffee machine's web interface went offline. Then, according to what I pieced together later from overheard conversations and one very stressed-looking facilities manager, every Jura coffee machine on the hospital's IoT network — there were ELEVEN of them — simultaneously entered a firmware recovery mode.

Eleven coffee machines. All of them bricked. At the same time. In a hospital.

You have not truly known fear until you are sitting in a hospital waiting room with a sprained wrist, watching a parade of increasingly panicked staff members speed-walking past you talking about a "critical beverage infrastructure failure," and you know — you KNOW — that you are the reason there are now eleven very expensive machines displaying the Jura logo on a loop like a screensaver from hell.

A nurse walked past me muttering "the coffee's down on ALL floors" with the same tone people use to announce a death in the family. A resident who looked like he hadn't slept since the Obama administration was staring at a vending machine like it had personally betrayed him. Someone from IT — I could tell because he had that specific haunted look — was on the phone saying "no, ALL of them. Yes, at the same time. No, I don't know why."

I know why.

I sat there for another forty-five minutes, very quietly, not touching my phone, radiating what I hope was an aura of complete innocence. When they finally called my name, the doctor who examined my wrist looked like he was running on fumes and sheer willpower. "Rough day?" I asked, casually. "You have no idea," he said. "The coffee machines are all down." I nodded sympathetically. I am a monster.

I went home, wrapped my wrist in a bandage, and immediately wrote up the vulnerability. Anonymous disclosure. Sent it to Jura's security contact, CC'd the hospital's general IT email with a very carefully worded "hey, you might want to look at your IoT segmentation" message. I did not mention that I was the one who had field-tested the vulnerability. Some things are better left unsaid.

Jura patched the firmware endpoint six weeks later. The hospital, to their credit, actually fixed their network segmentation within a week. I know because I checked. From the parking lot. On my phone. Because I am apparently incapable of learning from my mistakes.

The lessons here are simple:

1. Segment your IoT devices. For the love of God, segment your IoT devices.
2. Put a password on your coffee machine's admin panel. It's 2026. There is no excuse.
3. Don't poke at firmware update endpoints "just to see what happens."
4. If you ignore lesson 3 and break eleven coffee machines in a hospital, at least have the decency to disclose the vulnerability.
5. Hospitals run on coffee. Disrupting coffee in a hospital is, in a very real and not at all exaggerated sense, a threat to public health.

I still feel guilty about it. Every time I go to a hospital now, I bring my own coffee. It's the least I can do.

— d4rkfl0w, 2026