Pentagon investigates suspected cyberattacks: Did hackers trigger freezer failures at US military bases and put food supplies at risk?

The Pentagon is treating a string of freezer failures at US military base shops as a suspected cyberattack, four officials told Reuters on Thursday.

The failures happened in August. Investigators are now examining whether hackers were behind them, after a similar attack hit hundreds of supermarkets in France this month. One official said investigators have also spoken to French police about that case.

The freezers began warming in late August

The affected shops are commissaries, the grocery stores that serve people on US military bases. In late August, refrigerators and freezers at some of them switched to defrost mode and warmed up. Food spoiled.


Stars and Stripes reported that at least six bases had problems, including Fort Huachuca in Arizona and Fort Irwin in California. Military Times reported that the Pentagon confirmed at the time that some commissaries had refrigeration problems. It didn’t say what caused them.

Army and Air Force investigators, including an Army cybercrime unit, began looking into the failures soon afterwards. US Cyber Command, the military’s cyber operations arm, has since joined them. The Pentagon told Reuters its team was “working in close coordination with interagency and law enforcement partners.”

Officials are treating the incidents as a possible cyberattack, but nobody has publicly said what actually went wrong inside the stores.

France offered investigators a possible lead

In mid-October, attackers reportedly changed the settings on refrigeration systems at hundreds of French supermarkets. The units defrosted overnight. Inside some of them, temperatures climbed to around 50°C. TNW reported that about 150 Intermarché stores and nearly 100 Super U shops were affected.

In both countries, then, the equipment ended up in defrost mode. That is the main reason investigators are comparing the cases.

Many of the French stores used control boxes made by Danfoss, a Danish refrigeration company. A control box is the device that tells a cooling unit when to run and when to defrost. Danfoss told Reuters that many of the affected units were old or running outdated software. It didn’t respond to the agency’s questions about the US incidents.

Reuters couldn’t establish whether the military commissaries used Danfoss equipment. Records for at least one shop, at Naval Air Facility El Centro in California, do list a Danfoss control system. That is one store, and it doesn’t show what the other affected bases were running.

In August, the cybersecurity firm Claroty reported vulnerabilities in refrigeration controls made by Danfoss and Copeland. One of the flaws was a hidden login that could let an attacker take full control of a system. Danfoss has since released a fix.

A fix only protects a system once it has been installed. Danfoss itself said many of the French units were running outdated software.

Even so, the existence of a flaw isn’t proof that anyone used it. The vulnerabilities do not establish that they played a role in either incident. The Pentagon hasn’t confirmed that anyone gained access to the commissary systems, and it hasn’t explained what caused the failures.

The scale of what’s at stake is also unclear. The military agency responsible for the shops runs 235 commissaries worldwide. At least six bases have reported refrigeration failures, and investigators haven’t said whether the suspected attack reached systems beyond the stores that reported problems.