Pentagon Eyes Base Freezer Failures as Suspected Cyberattack
The Pentagon is now treating a string of refrigeration failures at U.S. military commissaries as a suspected cyberattack. Four officials told Reuters that investigators are working the August outages as a possible intrusion, and that U.S. investigators have contacted French police about a separate October attack on supermarket refrigeration in France. No one has confirmed that hackers actually did it.
The first reports came in late August. Freezers and coolers at Defense Commissary Agency stores slipped into defrost mode overnight, warming up and spoiling stock. Fort Huachuca in Arizona wrote on Facebook on Aug. 26 that its freezers had gone into defrost and heated all the food. At least six installations have publicly acknowledged problems, including Fort Irwin in California, F.E. Warren Air Force Base in Wyoming, Naval Station Newport in Rhode Island, and Columbus and Travis Air Force Bases.
Stores stayed open but sold dry goods only. The Defense Department's only early comment was that it was aware of a possible refrigeration disruption at some commissaries, and it would not say how many stores were hit or why. The agency runs 235 commissaries worldwide, so the affected group is a fraction of the system.
The investigation has widened since the first weeks. Army Criminal Investigation Division's Cyber Field Office and the Air Force Office of Special Investigations confirmed in early September that they were working the outages, and the Air Force said the Defense Criminal Investigative Agency is leading the effort. Per the October Reuters reporting, U.S. Cyber Command has also joined the probe. A Pentagon spokesperson said the team is working in close coordination with interagency and law enforcement partners.
The suspicion hardened after a much larger incident in France on the night of Oct. 11 to 12. Attackers reportedly pushed refrigeration units at several hundred supermarkets to as high as 50°C (122°F), causing food losses and some fires. The French prime minister ordered the National Cybersecurity Agency (ANSSI) to investigate, and the Paris prosecutor's office called it a "large-scale" attack. Reuters reports more than 350 French establishments were affected, including about 150 Intermarché stores and nearly 100 Super U shops.
Danfoss, the Danish equipment maker, said many of the affected French units were old or running outdated software. A source close to the French prime minister said ANSSI found a vulnerability in Danfoss-supplied software. Danfoss has released a fix.
The technical backdrop is public. In August, security firm Claroty published research on refrigeration controllers from Copeland and Danfoss. For the Copeland XWEB Pro line alone, the firm described 23 vulnerabilities, 21 rated high severity, including a login flaw and an administrator password derived from predictable values. In its own lab test, a compromised controller could show false temperatures while disabling cooling fans, so the contents spoiled while the display looked normal.
Exposure appears widespread. After the French attacks, the Shadowserver Foundation counted roughly 350 Danfoss AK-SM 800A units still exposed to the internet, down from more than 550 earlier that week, and other scanning firms reported thousands of exposed Danfoss StoreView panels. Copeland said its affected controllers were end-of-life products.
What remains unproven is the link. Reuters could not confirm that the commissaries used Danfoss equipment, though records for one store, at Naval Air Facility El Centro in California, list a Danfoss control system. Having a vulnerable product does not show it was exploited, and the Pentagon has not said anyone accessed commissary systems.
The accounts do not fully line up. Reuters and the newsletter coverage describe Fort Irwin's problems as a September event, but Military Times documented a Fort Irwin outage in late August. The count of affected bases also varies: at least six publicly confirmed, seven named in Military Times reporting, and a social media claim of 14 or more that has not been verified. This article treats "at least six" as the confirmed floor.
For now, the confirmed facts are narrow: multiple commissaries lost refrigeration, military cyber investigators are involved, and officials told Reuters they are treating it as a suspected attack. Everything else, including the cause, the vendor, and the attacker, is unresolved. Base operators and anyone running internet-connected refrigeration or building controls should treat the vendor patches as urgent and check whether those systems are reachable from the open internet. The next sign to watch is whether the Pentagon or French authorities publicly tie the two incidents to the same tooling.
