The Pentagon is investigating a cluster of freezer and refrigeration failures at U.S. military commissaries as a suspected cyber incident, according to multiple reports, after food spoiled at on-base grocery stores earlier this year.
Reuters reported on Oct. 29 that investigators were treating the August malfunctions as a suspected hack, citing four officials familiar with the matter. A Defense Department statement to Reuters said a unit of Cyber Command was “working in close coordination” with interagency and law enforcement partners. Task & Purpose separately reported that the Defense Criminal Investigative Service is leading a joint investigation, while Army Criminal Investigation Division is working with the Defense Commissary Agency, DCIS and French law enforcement.
Military Times reported in late August that more than a half-dozen commissaries in the continental U.S. had reported refrigeration outages. The affected locations named in that report included Fort Irwin, California; Holloman Air Force Base, New Mexico; Naval Station Newport, Rhode Island; Little Rock Air Force Base, Arkansas; F.E. Warren Air Force Base, Wyoming; Robins Air Force Base, Georgia; and Fort Huachuca, Arizona.
At the time, the Pentagon acknowledged a possible refrigeration disruption at some Defense Commissary Agency commissaries but did not identify a cause. Some stores temporarily limited sales to dry goods, while officials said temperature-sensitive products were being transferred where possible to limit losses and protect food safety.
Stars and Stripes later reported that Army Criminal Investigation Division’s Cyber Field Office and the Air Force Office of Special Investigations had active investigations into refrigeration outages that occurred within days of each other. The report said at least six bases or stores had shared public information about outages that affected meat, dairy, produce or frozen food sales.
The most striking detail came from Fort Huachuca, where the installation described an overnight equipment failure in which all freezers went into defrost mode and frozen food spoiled. Reuters reported that, in at least one U.S. case, the issue was not simply a loss of cooling but an overnight temperature increase.
France shows what a refrigeration cyberattack can look like
The U.S. investigation is drawing attention partly because France suffered a confirmed large-scale cyberattack against supermarket refrigeration systems in October.
On Nov. 2, retailers in at least seven European countries reported a second wave of suspected attacks on refrigeration systems, according to The Guardian and Claroty. The Guardian reported on Nov. 3 that UK food suppliers were also affected, with the National Cyber Security Centre describing the national impact as minimal.
Reuters reported that hackers overrode temperature controls at more than 350 French establishments, forcing supermarkets to clear spoiled merchandise. Le Monde reported that stores across several supermarket groups were hit overnight from Oct. 11 to Oct. 12, with some cold rooms and freezers reaching 50°C. Some stores reported fires. Others suffered water damage when overheated equipment triggered sprinkler systems.
France’s CERT-FR, part of the national cyber agency ANSSI, issued an alert for compromises involving remote refrigeration controllers. The affected systems named in the alert included Danfoss AK-SM and AK-SC series equipment as well as Copeland xweb and Dixell xweb systems. CERT-FR advised operators to remove internet exposure for affected units, restore access only through a secured VPN or protected network, update firmware and ensure default passwords had been changed. The alert also warned that attack campaigns were probably still ongoing against those types of equipment.
The French case does not prove the U.S. commissary failures were caused by the same attackers, the same vulnerability or the same equipment. Reuters said it could not establish whether Danfoss or any other freezer-controller brand was used at the affected U.S. bases.
The technical concern is the controller, not the freezer
The broader risk sits in the control systems used to monitor and manage refrigeration equipment remotely.
In August, Claroty’s Team82 research group published findings on Danfoss AK-SM 800A refrigeration controllers. The researchers said the platform is used to manage refrigeration infrastructure in supermarkets, cold-storage facilities, warehouses and other commercial environments. They reported finding multiple vulnerabilities in the embedded web management interface, including an authentication bypass, command injection leading to remote code execution and a denial-of-service path. Claroty said Danfoss addressed the issues in new firmware.
Claroty also published research on Copeland XWEB Pro controllers, reporting 23 vulnerabilities, 21 of them high severity. The researchers said a compromised supervisory controller could let an attacker manipulate refrigeration systems and silently spoil temperature-sensitive contents in a test environment. Copeland addressed those issues in firmware version 1.13, according to Claroty.
Those research findings are not evidence that the Pentagon incidents used those specific vulnerabilities. They do show why remote refrigeration management systems are credible cyber targets: they connect digital access to physical outcomes, including food spoilage, equipment damage and interrupted operations.
Attribution remains unsettled
A separate Nextgov/FCW report, citing two people familiar with the matter, said U.S. officials suspect Iran-linked hackers may be behind the freezer incidents. The report also said it was not clear how cyberintruders may have accessed the systems and that assessments could change as investigators learn more.
As of Nov. 2, the Pentagon had not publicly attributed the commissary failures to a specific actor, country, exploit or vendor. Public reporting has not established what systems were affected.
Refrigeration outages can come from ordinary equipment failure, maintenance problems, misconfiguration or unauthorized access. In cyber investigations involving operational technology, early technical similarities can be misleading without logs, device images, network records and forensic evidence from affected sites.
The operational lesson for connected facilities
The commissary investigation puts a practical spotlight on a class of systems that often sits between facilities, IT and outside maintenance providers. Refrigeration, HVAC and other building-control systems are frequently connected for valid reasons, including monitoring, alarms and remote service. The risk rises when those management interfaces are exposed to the public internet, run outdated firmware or depend on shared credentials.
For organizations that manage cold storage, food retail, healthcare storage, warehouses or building controls, the lesson is not to treat refrigeration as ordinary equipment once it has remote management. It should be inventoried, patched, segmented and monitored like any other operational system that can cause real-world loss if compromised.
Internet exposure needs to be known and reduced. Remote access should not mean public access to controller interfaces.
Firmware and end-of-life status matter. Older controllers can become long-term risk points if they no longer receive fixes.
Vendor and maintenance access needs controls. Third-party access should be limited, logged and routed through protected systems.
Food-safety response plans need cyber assumptions. A temperature excursion may require both facilities response and cyber investigation.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
