Pentagon investigates military commissary freezer failures as suspected cyberattack

Overview

Updated 1 hour ago

Late in August, staff at Fort Huachuca's commissary arrived to find every freezer in defrost mode and the frozen food spoiled. The same overnight failure hit commissaries at five other bases, from Fort Irwin in California to Robins Air Force Base in Georgia, and left some stores selling only dry goods.

Three months later, the Pentagon still will not say what happened. Its criminal investigators are treating the failures as a possible cyberattack and comparing notes with French authorities, who traced an October attack on supermarket freezers to a unit of Iran's Revolutionary Guard.

Why it matters

If base cooling systems can be turned up remotely, commissary food security depends on controller security, not stockpiles.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

U.S. commissaries reporting freezer failures

At least six; unverified reports suggested up to a dozen.

700

French stores hit in the October attack

The Paris prosecutor's count; Reuters reported more than 350 establishments.

~20

Fires in French stores during the attack

Prosecutors linked the fires to freezer temperatures driven up remotely.

25%

Commissary savings versus civilian supermarkets

The discount that turns lost perishables into a household budget problem.

90 days

Pentagon's FORTRESS sustainment goal

Target for major installations to keep operating without outside support.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Thomas Hamilton

Public affairs officer, Department of the Army Criminal Investigation Division

Serving as spokesperson for the Army's side of the inquiry

Gene Moody

Field chief technology officer, Action1

Outside cybersecurity commentator quoted in coverage of the probe

Organizations Involved

Defense Criminal Investigative Service

Federal criminal investigative agency

Leading the joint investigation into the freezer failures

The Pentagon's criminal investigative arm, now running the commissary freezer inquiry alongside Army investigators and the commissary agency.

Defense Commissary Agency

Defense Department Agency

Operating the affected stores and part of the investigation

Runs the on-base grocery stores where the freezers failed, and says it moved products to other temperature-controlled sites to limit losses.

Army Criminal Investigation Division

Military investigative agency

Its Cyber Field Office is working the case with French law enforcement

The Army's investigative branch, whose cyber unit is comparing the U.S. outages with attacks on European refrigeration systems.

U.S. Cyber Command

Unified combatant command

A unit is coordinating with interagency and law enforcement partners

The military's cyber force has a unit supporting the investigation, the Pentagon said, without elaborating.

Danfoss

Manufacturer

Its controllers ran many of the French units attacked in October

The Danish manufacturer said many of the affected controllers were obsolete or running outdated firmware, which could have eased break-in.

Islamic Revolutionary Guard Corps (IRGC)

Paramilitary force

Accused by Paris prosecutors of carrying out the French freezer attack

The Paris prosecutor's office said a cyber unit of the Guard hit about 700 French retail locations in October.

Timeline

2015 November 2026

10 events Latest: Today

Tap a bar to jump to that date

November 2026
Investigators confirm coordination with French authorities
Today Investigation

The Defense Criminal Investigative Service, Army cyber investigators and the commissary agency are working with French law enforcement; no cause or culprit is public.
Today
Two months on, Pentagon won't give a store count or a cost
Statement

Citing the open investigation, officials declined to say how many stores lost refrigeration or what spoiled food cost.
November 4th, 2026
Paris prosecutor blames Iran's Revolutionary Guard
Attribution

Prosecutors accused a Guard cyber unit of hitting about 700 stores; similar hacks followed in Belgium, Luxembourg and Sweden.
November 2026
U.S. agencies warn operators about refrigeration hacks
Advisory

The warning covered attacks that can hide current temperatures from operators, making conditions inside units harder to monitor.
November 2026
October 2026
French cyber team flags exposed refrigeration controllers
Advisory

Alert named Danfoss AK-SM and AK-SC units plus Copeland and Dixell XWEB systems, and urged removing them from the public internet.
October 12th, 2026
Cyberattack raises freezer temperatures across French supermarkets
Cyberattack

Freezer aisles were cleared of spoiled food; prosecutors later counted about 20 fires.
October 11th, 2026
Pentagon confirms criminal probe into suspected cyberattack
Investigation

Reuters reported a U.S. official describing the inquiry as a cyberattack investigation; no cause or suspect was named.
October 2026
September 2026
Four commissaries in Germany and England lose refrigeration
Incident

The commissary agency called those outages equipment failures and parts delays, unrelated to the U.S. cases.
September 2026
August 2026
Freezers defrost overnight at six commissaries
Incident

Fort Huachuca reported every freezer entered defrost mode; Fort Irwin and Newport limited shoppers to dry goods.
August 2026
2015
Federal review flags control-system gaps at installations
Report

A government review found shortcomings in how the Defense Department secures the digital controls running installation utilities.
2015

Scenarios

Investigators confirm a deliberate hack on commissary freezers

Possible Resolves by Q2 2027

Discussed by: Reuters, citing a U.S. official who described the inquiry as a suspected cyberattack investigation

This resolves if the Defense Criminal Investigative Service or the Pentagon states that a remote intrusion caused the August failures. Investigators would need to match the controller models and firmware at the affected stores to something an attacker could reach. The French case gives them a working template: controllers exposed to the internet, outdated firmware, and setpoints changed overnight. Naming a specific group would take longer than establishing that a hack occurred.

Pentagon closes the case as equipment failure

Possible Resolves by Q2 2027

Discussed by: The commissary agency's own account of the German and British outages, which it blamed on failed equipment and slow parts deliveries

The agency has already attributed a separate September cluster in Germany and England to hardware problems. If the August failures follow the same path, the case ends as a maintenance and procurement issue. Investigators would still need to explain why several stores failed in the same overnight window.

The case stays open and no cause is ever made public

Uncertain Resolves by End of 2027

Discussed by: Pentagon statements declining to answer questions on security grounds, reported by Stars and Stripes

Criminal investigations routinely end without a public report, and the Pentagon has already refused to release the store count and the cost of lost food. Without a statement, the August failures become an unresolved footnote and the stores restock under the same equipment. This is the default outcome if nothing forces disclosure.

Commissary cooling controllers are ordered off the public internet

Possible Resolves by End of 2027

Discussed by: A joint U.S. agency warning on refrigeration hacks, and French guidance to remove controllers from direct internet access

The French alert said resetting compromised equipment would not be enough if the underlying exposure remained. A U.S. version of that rule would require the commissary agency to inventory every networked cooling controller and route remote access through a secured network. This could happen before anyone establishes what caused the August failures.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

Discovered 2010

Stuxnet (2010)

A worm built to attack Siemens industrial controllers at Iran's Natanz enrichment plant spun centrifuges to destruction. Widely cited estimates put the toll near 1,000 machines.

Then

Operators worldwide began treating industrial control systems as an attack surface rather than sealed machinery.

Now

The operation set the template for code that damages physical equipment by manipulating its settings.

Why this matters now

The freezer attacks are a cheap civilian version of the same idea: altering setpoints rather than destroying machinery, on equipment many operators never considered networked.

November-December 2013

Target breach through an HVAC contractor (2013)

Attackers reached Target's payment network using credentials stolen from a refrigeration and heating contractor in Pennsylvania, and took about 40 million card records.

Then

Target disclosed the breach in December 2013 and its chief information officer resigned the following year.

Now

Vendor and contractor access became a standard item in retail security reviews.

Why this matters now

It shows how a refrigeration vendor's remote access can be the door into a much larger system, which is the question hanging over the commissary case.

2015

GAO review of installation utilities (2015)

A government review warned that disruptions to installation utilities could threaten military missions and found gaps in how the Defense Department secures the digital controls running them.

Then

The findings added to a running list of infrastructure vulnerabilities at bases.

Now

The risk stayed on the books without a public fix, and the Pentagon's FORTRESS planning now targets 90 days of self-sufficient operation at major installations.

Why this matters now

The commissary failures show the gap the review described: stockpiling food offers little protection if the equipment preserving it can be disabled.