Freezer Hacks Expose a Pentagon-Scale Cybersecurity Risk

By Daniel Okafor

France this week attributed attacks on refrigeration units at more than 700 stores to Iran’s Islamic Revolutionary Guard Corps, which denied responsibility, and Foreign Minister Jean-Noel Barrot vowed to seek sanctions and other unspecified measures.

The attacks caused spoiled food during October and November. French officials said early-November incidents also hit blood banks, though early-warning systems prevented any blood from spoiling.

What do the freezer attacks show?

Pentagon Chief Information Officer Kirsten Davies said the U.S. significance of the European supermarket hacks dawned on her abruptly when she first read about them. Her immediate reaction was:

“Holy cow! What else uses refrigeration?”

She called the freezer hacks “a wake-up call for society.” Davies described operational technology as the software and hardware used for industrial processes and critical infrastructure. In her assessment, attackers could compromise connected controls with surprising ease and produce direct physical effects, as if an attack were “reaching through digital wires and touching you.”

At military bases, Davies listed blood banks, plasma and organ donation, and food manufacturing and transportation as vital functions that could be affected.

That mechanism turns an apparently narrow digital intrusion into a physical failure, because operational technology directly governs equipment used for refrigeration, treatment, production and transport.

What happened at U.S. military installations?

Six U.S. military installations acknowledged in public statements that freezers at their commissaries went out simultaneously during August. Commissaries sell discounted food to soldiers and their families. The installations gave no reason for the outages.

Davies said she could not comment on incidents affecting U.S. military facilities. The Army Criminal Investigation Division said it was working with other investigators to determine the full extent of what occurred.

A Defense Department official said the Pentagon does not comment on intelligence-related matters as a matter of practice. The official referred the reporter to the French government statement attributing responsibility to Iran.

The public account therefore stops short of a Pentagon finding on cause for the six bases, while French authorities point to Iran for the European attacks and Tehran rejects that allegation.

Why does operational technology matter to defense?

Along with one other senior Pentagon official, Davies safeguards U.S. defense critical infrastructure on which the military system relies. She said the hacks underline the need to strengthen operational-technology security, especially for physical equipment that may connect to the internet.

Davies called attacks on military operational technology “a real threat vector.” She then described the scope: “Think about the Navy, and all of the ships and the submarines, and the airplanes, and the software platforms that actually run the way in which a plane would be operating.”

The U.S. military relies on blood banks to treat wounded personnel and on civilian infrastructure for power, water and fuel systems. Davies said those systems are susceptible to attacks against internet-connected machinery. She also said similar attacks could affect weapons systems.

Across a force of about 3 million people, the exposure combines blood-bank dependencies, civilian utilities, connected machinery and platforms that can influence how aircraft, ships and submarines operate.

How is the Pentagon responding?

Davies said the Pentagon is “ramping up” its response to attacks the agency considers relatively “easy to perpetrate.” Its response starts with basic cybersecurity hygiene.

Davies also said the Pentagon is leaning on “agent swarms,” groups of artificial intelligence agents that work together to inventory defense critical infrastructure and the problems affecting it.

Davies acknowledged the risk. AI agents have recently spun out of control in a number of alarming scenarios. Her approach is controlled deployment:

“We’re being very careful about how we program them, have guardrails around them, put them in sandbox environments to test it first.”

She described sandboxes as isolated virtual environments where AI agents can be tested safely. Despite those risks, Davies said AI can help address the scale of the inventory. She put the size this way: “I think people have no idea how large we are.” She added: “I haven’t found the edge of that yet.”

Her inventory has not reached its edge, so the practical test is whether the Pentagon can turn that inventory into tested safeguards for the connected equipment Davies says adversaries can exploit. The six August outages give that work an immediate operational measure: determine what failed, whether the failures shared a cause, and how commissary refrigeration can withstand another outage.