Commissary Freezer Failures Spur Cyberattack Probe at US Military Bases

The Pentagon is investigating whether cyberattacks caused a series of commissary refrigeration failures that spoiled groceries and restricted food sales at military installations in August, with investigators now coordinating with French authorities following similar disruptions overseas.

The Defense Criminal Investigative Service (DCIS) is leading the joint investigation, which includes Army criminal investigators and the Defense Commissary Agency (DeCA).

A U.S. official familiar with the matter described the inquiry as an investigation into a suspected cyberattack. Investigators have not publicly established what caused the failures or who might be responsible.

The Pentagon has acknowledged speculation about a cyber incident but has declined to discuss the ongoing criminal investigation.

Freezers Entered Defrost Mode

The August disruptions reached installations across several states. Public notices identified problems at Fort Irwin, Calif.; Fort Huachuca, Ariz.; Naval Station Newport, R.I.; and Holloman, Little Rock, F.E. Warren and Robins Air Force bases.

At Fort Huachuca, officials described an overnight failure that sent every freezer into defrost mode. “ALL freezers went into defrost mode – ALL frozen food has spoiled,” the installation announced.

Newport limited purchases to dry goods, while Fort Irwin initially stopped selling eggs and milk before announcing that only dry goods would remain available. Those store restrictions disrupted access to staples even where commissary doors stayed open.

The department said DeCA transferred products to other temperature-controlled locations to limit losses and took precautions to protect food safety. Its initial response did not establish a common cause for the failures.

French Attacks Provide a Warning

Army investigators have confirmed they are working with DCIS and French law enforcement to understand refrigeration outages in Europe.

That cooperation follows confirmed attacks on French supermarket refrigeration systems in October, but it does not establish that the same attackers or technical weaknesses were involved in the U.S. incidents. At this time, no group has claimed responsibility.

France’s national cybersecurity response team issued an Oct. 12 alert identifying numerous compromises of Danfoss AK-SM and AK-SC refrigeration controllers and Copeland and Dixell XWEB systems.

Its recommendations included removing controllers from the public internet, checking configurations and defrost schedules, updating firmware, and restoring remote access only through a secured network or virtual private network.

The French guidance also warned that resetting compromised equipment alone would be insufficient if the underlying exposure remained.

For equipment no longer receiving security updates, continued internet exposure created a high risk of renewed compromise. U.S. military investigators have not determined whether the same vulnerabilities caused the commissary failures.

Commissaries offer military families at least 25% overall savings compared with civilian supermarkets. When refrigeration failures leave stores selling only dry goods, families must buy milk, eggs, meat and other perishables elsewhere, potentially increasing their grocery bills.

Losing access to discounted staples can add pressure to the household budgets those programs were intended to support.

An Older Infrastructure Vulnerability

The investigation comes as the Pentagon pursues its FORTRESS initiative, including a reported goal for major U.S. installations to sustain essential operations for at least 90 days without outside support.

The commissary failures highlight another vulnerability: Stockpiling food offers limited protection if the equipment preserving it can be disabled.

The wider defense concern has been documented for years. A 2015 GAO review warned that disruptions to installation utilities could threaten military missions and found shortcomings in Defense Department cybersecurity implementation for industrial control systems.

The report addressed utilities, not these commissary freezers, but identified the broader risk posed by digital controls operating physical infrastructure.

Officials have declined further details on security grounds, leaving shoppers without a confirmed explanation for the failures. The investigation must determine whether equipment malfunctioned or someone deliberately altered its operation.

For families depending on commissary savings, the practical test will be whether the department can keep refrigerated food available and prevent another disruption.