Pentagon

Summary

Pentagon officials are investigating whether hackers caused refrigeration failures at military commissaries, with investigators treating the incidents as a suspected cyberattack and coordinating with interagency and law enforcement partners. The failures caused freezers to switch to defrost mode and spoil food at shops on at least six bases, while a parallel disruption affected hundreds of supermarkets in France. Army and Air Force investigators, including a cybercrime unit, and US Cyber Command have joined the inquiry, though the department has not confirmed that anyone gained access to the systems or identified a cause. Records link at least one affected shop to a Danish refrigeration control system, and researchers previously disclosed vulnerabilities in similar equipment, though no connection to the events has been established.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Pentagon began investigating in late August 2026 after refrigerators and freezers at military commissaries on several US bases switched to defrost mode and warmed up, causing food to spoil. At least six bases reported problems, including Fort Huachuca in Arizona and Fort Irwin in California. The military agency responsible for the shops operates 235 commissaries worldwide. When the failures first occurred, the Pentagon confirmed that some commissaries had experienced refrigeration problems but did not provide a cause. Army and Air Force investigators, including an Army cybercrime unit, began examining the failures soon afterwards. US Cyber Command, the military’s cyber operations arm, subsequently joined the investigation. The Pentagon told Reuters that its team was working in close coordination with interagency and law enforcement partners. Four officials told Reuters that investigators were treating the US incidents as a suspected cyberattack. One official said investigators had also spoken to French police about a more recent case involving similar failures.

The French incidents offered investigators a possible lead because in mid-October attackers reportedly changed settings on refrigeration systems at hundreds of supermarkets, causing them to defrost overnight and pushing temperatures inside some units to around 50 degrees Celsius. About 150 Intermarché stores and nearly 100 Super U shops were affected. Many of the French stores used control boxes made by Danish refrigeration company Danfoss, which told Reuters that many affected units were old or running outdated software. Danfoss did not respond to questions about the US incidents, and Reuters could not establish whether the military commissaries used Danfoss equipment. Records for at least one shop, at Naval Air Facility El Centro in California, list a Danfoss control system. In August, cybersecurity firm Claroty reported vulnerabilities in refrigeration controls made by Danfoss and Copeland, including a hidden login that could allow an attacker to take full control of a system. Danfoss has since released a fix, though the vulnerabilities do not establish that they were used in either incident. The Pentagon has not confirmed that anyone gained access to the commissary systems or explained what caused the failures. Investigators have yet to say whether the suspected attack affected systems beyond the stores where the refrigeration failures were reported.

Sources

Sources available to members: 1 source.