Pentagon Treats Commissary Freezer Failures as Suspected Cyberattack

The Pentagon's criminal investigators are treating August refrigerator failures at more than a half-dozen U.S. military commissaries as a possible cyberattack, four officials told Reuters this week. The Defense Criminal Investigative Service, the criminal arm of the agency's Office of Inspector General, is leading a joint probe. The Pentagon declined to elaborate: "For security reasons, we do not comment on ongoing law enforcement investigations," it said in a statement to Fortune.

The suspicion is not idle. Weeks before the probe became public, hackers seized refrigeration controls at hundreds of French supermarkets overnight and pushed temperatures above 122 degrees Fahrenheit, spoiling food and starting fires. There is no proof the two events are connected — or that the commissary failures were a hack at all. But the pattern caught the attention of Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University.

"You'd be silly not to be suspicious," he told Fortune.

What happened in France?

The French attack hit on a large scale. Affected stores included 80 Carrefour locations, roughly two dozen Monoprix stores, and 150 Intermarché stores, according to Reuters. The Paris prosecutor's office called the outages a "large-scale" attack. Similar outages were reported across Europe.

The bill is already concrete. Two supermarket operators, Intermarché and E.Leclerc, reported an estimated €270,000 — about $300,000 — in combined stock damage, according to the local outlet Sud Ouest. That figure covers two chains among hundreds of affected stores, so the true cost is likely higher.

The damage also has an unusual quality for a cyber incident: it cannot be reversed. "Refrigerators give an attacker a weirdly direct route…to financial loss that's, with cyber, unusually irreversible," Whyte said. "You can't unspoil food or other products from these freezers. It's just Euros and dollars down the drain."

Which bases were hit?

The August disruption affected commissaries at seven named U.S. military installations, as Military Times reported at the time:

• Fort Irwin, California
• Holloman Air Force Base, New Mexico
• Naval Station Newport, Rhode Island
• Little Rock Air Force Base, Arkansas
• F.E. Warren Air Force Base, Wyoming
• Robins Air Force Base, Georgia
• Fort Huachuca, Arizona

Commissaries sell subsidized goods to base residents at roughly 25% below civilian grocery prices. That subsidy is the point of the target: an army, as the aphorism attributed to Napoleon Bonaparte and Frederick the Great goes, marches on its stomach. The Substack Signal and Silence was first to report the possibility that the outages resulted from a hack.

Why refrigeration, and why now?

French authorities traced the supermarket vulnerabilities to remote controllers for refrigeration systems — the Danish-made Danfoss AK-SM and AK-SC series, plus Copeland xweb and Dixell xweb units — running outdated firmware that hackers could exploit through internet access, according to an alert bulletin from French cyber authorities.

The problem generalizes. Refrigeration equipment is often identical across commercial chains, so one identified exposure can be replicated across many systems at once, Whyte said. Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, told Fortune that hacking of home fridges was a running joke among her colleagues — and that the punchline arriving late surprised her.

"I'm surprised that it took so long," she said. "A lot of these devices have a lot of really cool features, but the security is not the first priority for them. Hopefully future inventions will come with more security in mind when it comes to the design, and the existing ones also will be revisited to incorporate all the potential vectors of the cyberattacks."

The backdrop is a widening attack surface. Cybercrime is projected to cost the global economy $10.8 trillion this year, according to Cybersecurity Ventures — more than triple the $3 trillion it cost in 2015, a jump of roughly $7.8 trillion in a decade. The Center for Strategic and International Studies logged more than a dozen major attacks in September alone. Rapidly developing AI capabilities have made hacking more sophisticated, while the growing number of internet-connected appliances multiplies the targets.

The U.S. military's own logistics record shows the stakes. The USS Abraham Lincoln, which docked in San Diego this month after a record 265 uninterrupted days at sea, became a symbol of strain in military amenities: its crew faced poor morale and mental health problems during its Iran war mission, partly from food and hygiene supply shortages.

Is this a state actor's work?

Gregory Winger, an assistant professor of international relations and cybersecurity at the University of Maryland, Baltimore County, told Fortune that actors from Russia, China, Iran, and North Korea typically rely on cyber incidents that appear random but are actually connected. Attribution, in other words, remains an open question — and the Pentagon has not offered one publicly.

The joint U.S.-French investigation makes sense regardless of whether the two outbreaks share an author, Winger argued. NATO already runs a cybersecurity headquarters, Supreme Headquarters Allied Powers Europe in Mons, Belgium, built to identify and share hackers' techniques. A significant attack could even trigger Article 5, the collective defense clause that treats a threat against one of the alliance's 32 members as a threat against all.

"Right now," Winger said, "every future military operation is going to have a cyber component to it."

For now, the investigators hold the facts. What is not said — no confirmed attribution, no published evidence of intrusion at the commissaries — matters as much as the suspicion itself. The case will test whether connected refrigeration, cheap to attack and impossible to undo, becomes a standard lever in economic and military coercion.