Pentagon investigates suspected cyberattack behind freezer failures at US military bases
By Jahanzaib Saqib — SCN NEWS
WASHINGTON, — The Pentagon is investigating a series of unusual freezer malfunctions at United States military installations as a suspected cyberattack, raising concerns about the security of digitally connected equipment used to preserve food supplies for military personnel and their families. The investigation involves military cybersecurity specialists and federal law enforcement authorities, who are also coordinating with French investigators examining a separate attack on commercial refrigeration systems that disrupted hundreds of businesses across France.
The suspected incidents occurred in late August at commissaries on at least six American military bases, according to a Reuters investigation published Thursday. Commissaries are government-operated grocery stores serving eligible military personnel and their families, making reliable refrigeration essential for maintaining safe food supplies. In at least one documented incident, freezer temperatures increased unexpectedly overnight rather than simply losing power, leaving large quantities of frozen food spoiled and forcing the affected facility to address the resulting losses.
Four officials familiar with the matter told Reuters that the Pentagon was treating the incidents as a possible hacking operation. The Defense Department confirmed that a unit of U.S. Cyber Command was coordinating with other government agencies and law enforcement partners, while the Army Criminal Investigation Division acknowledged that its Cyber Field Office was participating in the inquiry. Officials have not disclosed whether investigators have identified evidence proving unauthorised access, established a common cause for the malfunctions or determined who might have been responsible.
The investigation highlights an increasingly important security concern for military facilities and civilian businesses alike. Modern refrigeration equipment frequently relies on electronic controllers that regulate temperatures, monitor operating conditions and communicate with maintenance systems. When such devices are connected to computer networks or the internet without adequate security protections, they can create potential points of entry for attackers seeking to interfere with physical operations rather than merely steal information.
The most clearly documented American incident occurred at Fort Huachuca, an Army installation in Arizona. On August 26, the installation's commissary reported that a freezer had entered defrost mode and warmed the food stored inside, making the products unsuitable for sale. The unusual behaviour drew attention because the equipment appeared to have changed its operating state, a distinction that investigators may need to examine when determining whether the malfunction resulted from technical failure, human error or deliberate interference.
Reuters identified at least six affected commissaries through contemporaneous announcements issued by military installations during August. However, the available public information does not establish that every malfunction resulted from the same technical problem or that the incidents were coordinated. Investigators will need to distinguish between ordinary equipment failures and evidence of malicious activity before concluding that the disruptions formed part of a cyberattack.
The involvement of U.S. Cyber Command gives the investigation particular significance because the organisation is responsible for conducting military operations in cyberspace and supporting the protection of Defense Department networks. Its participation does not, by itself, establish that the incidents were caused by a foreign adversary or a sophisticated cyber operation. The Army Criminal Investigation Division's involvement similarly reflects the need to examine potential criminal activity while preserving the distinction between suspicion and confirmed findings.
American investigators are also communicating with authorities in France following a separate cyberattack that affected refrigeration systems at more than 350 commercial establishments earlier in October. French supermarkets and other businesses experienced abnormal temperature changes that spoiled frozen food, while some refrigeration units reportedly became hot enough to catch fire. The scale of those incidents demonstrated how interference with relatively specialised industrial equipment can produce widespread financial losses and physical safety hazards.
The similarities between the American and French cases have attracted attention because both involved refrigeration equipment behaving in ways that could destroy stored food. In France, attackers reportedly manipulated temperature controls rather than merely interrupting electrical supplies, producing effects resembling the abnormal defrost conditions documented at Fort Huachuca. Nevertheless, investigators have not established that the incidents in the two countries were connected or carried out by the same individuals.
The U.S. Army Criminal Investigation Division confirmed that its Cyber Field Office was working with French law enforcement to understand the refrigeration disruptions in Europe. Such cooperation could help investigators compare technical evidence, identify common equipment vulnerabilities and determine whether the incidents involved similar methods. The French Embassy in Washington declined to comment on the investigation, and American officials have not disclosed the results of their exchanges.
The French incidents have also drawn attention to the security of older industrial control equipment. Danish engineering company Danfoss, whose refrigeration controllers were used in many affected French locations, previously indicated that numerous devices were obsolete or operating outdated software. Equipment that is no longer receiving security updates may be more vulnerable when connected to modern networks, particularly if its original design assumed that technicians would access it only from the physical installation.
Reuters could not establish whether Danfoss controllers or equipment from another manufacturer were installed at the American military facilities affected in August. That uncertainty is important because the presence of a vulnerable product in one country's incident does not demonstrate that the same technology or weakness was involved elsewhere. Identifying the specific controllers, software versions and network configurations used at the military commissaries will be necessary before investigators can determine whether the American failures share a technical explanation with the French attacks.
The potential consequences extend beyond the immediate financial losses associated with spoiled food. Refrigeration is an essential component of food distribution, supporting the storage and transportation of products that must remain within controlled temperature ranges. A prolonged disruption can force operators to discard inventory, interrupt deliveries and close affected facilities while equipment is inspected or repaired. In military communities, such disruptions may also affect access to groceries for service members and their families.
The investigation therefore illustrates a broader national security challenge involving operational technology, the specialised electronic systems used to control physical equipment. Unlike conventional office computers, these devices may remain in service for many years and can be difficult to update without interrupting business operations. Their increasing connection to remote monitoring and maintenance platforms creates additional security considerations for organisations that previously treated refrigeration, heating and other building systems primarily as mechanical infrastructure.
Industrial cybersecurity specialists have warned that equipment originally designed for isolated operation can become exposed when connected to wider networks without appropriate safeguards. The concern is not limited to refrigeration systems. Similar questions arise for