Pentagon Probes Suspected Commissary Freezer Cyberattack on U.S. Bases

Featured image: A Defense Commissary Agency official and a U.S. Space Force officer inside the Los Angeles Air Force Base commissary (file photo). Photo: U.S. Space Force photo by Van Ha, Public domain, via Wikimedia Commons.

The Pentagon is investigating a commissary freezer cyberattack: officials now treat the freezer failures that spoiled food at stores on at least six U.S. military bases in late August as a suspected hack, four officials told Reuters on Thursday, Oct. 29. Investigators are also in contact with French police about a similar attack that hit more than 350 French supermarkets this month.

Asked about the case, the Pentagon said a unit of U.S. Cyber Command was “working in close coordination with interagency and law enforcement partners,” Military Times reported, carrying the Reuters story. The Army Criminal Investigation Division said its Cyber Field Office was involved and was working with French law enforcement to understand “the refrigeration outages in Europe.”

What happened at the base commissaries

Commissaries are the grocery stores on military bases where service members and their families buy food. A Reuters review of base Facebook posts and website updates found at least six affected in late August. Stars and Stripes reported that they included Fort Huachuca in Arizona and Fort Irwin in California, according to The Next Web.

The failures were not simple outages. At Fort Huachuca, the store’s Facebook account wrote on Aug. 26 that its freezer “went into defrost mode where it heated up all the food.” Turning the cooling up rather than off is the detail that makes investigators suspect sabotage, because it matches what happened in France.

Reuters said it could not determine how far the investigation has gone or whether investigators have identified a culprit. The Pentagon has not confirmed that anyone broke into commissary systems. A recently created blog called Signal and Silence first raised the possibility of cybersabotage on Aug. 28.

The French supermarket freezer attack

In mid-October, attackers overrode temperature controls on commercial cooling units in more than 350 French stores, Reuters reported. Some units got so hot they caught fire, and temperatures in some reached about 50 degrees Celsius (122 degrees Fahrenheit), according to The Next Web, which said about 150 Intermarché stores and nearly 100 Super U shops were affected. One supermarket owner estimated total costs could reach tens of millions of euros.

Many of the French units used controllers made by the Danish company Danfoss, which told Reuters that many affected devices were obsolete or running outdated firmware. Reuters could not establish whether Danfoss equipment was in use at the U.S. bases, but records for the commissary at Naval Air Facility El Centro in California list a Danfoss control system, The Next Web reported. In August, the security firm Claroty disclosed flaws in Danfoss and Copeland refrigeration controls, including a hidden login that could give an attacker full control; Danfoss has released a fix. None of that proves the flaws were used in either attack.

By the numbers: how wide the damage could be

Source: Reuters, via Military Times and Investing.com; The Next Web. Table: The Boston Report.

The Defense Commissary Agency runs 235 commissaries worldwide. The six confirmed U.S. cases equal about 2.6% of that network, by a Boston Report calculation. The French incident was roughly 58 times larger by site count, though the U.S. tally is a minimum built from public base posts, not an official figure.

Why a freezer hack matters for national security

If confirmed, the case would show how exposed cold storage, a quiet piece of critical infrastructure, is to remote attack. Refrigeration plays a critical role in distributing fresh food, Reuters noted, and remote sabotage of cold storage has long been a concern for security researchers. Corporate cyberattacks have already hit companies close to home, including the cyberattack that cost Boston Scientific $150 million in the third quarter, and researchers at Harvard have published a warning on AI and terrorism risk.

What to watch: whether Cyber Command or the Army names a suspect, whether the Pentagon says any commissary systems beyond the refrigeration controllers were reached, and whether U.S. agencies issue guidance to replace or patch older controllers.

Sources

• Military Times (Reuters): Pentagon treating military base freezer malfunctions as suspected cyberattack
• Reuters via Investing.com: Exclusive on the Pentagon freezer probe
• The Next Web: Pentagon suspects hackers behind freezer failures at US base stores