Pentagon treats freezer failures at US military base stores as a suspected cyberattack
October 29, 2026 (Failures in late August; treated as a suspected cyberattack on October 29, 2026)
Freezers and refrigerators at military commissaries, the grocery stores on US bases, switched to defrost mode and warmed overnight in late August, spoiling food. The Pentagon confirmed refrigeration problems around August 28 without giving a cause. At least six bases reported problems, among them Fort Huachuca in Arizona and Fort Irwin in California. On October 29 Reuters reported that investigators are treating the failures as a suspected cyberattack, with Army and Air Force investigators looking into it and US Cyber Command now involved. Reuters could not confirm which equipment the stores used, though a record for one shop lists a Danfoss control system. Claroty reported flaws in Danfoss and Copeland refrigeration controllers in August, including a hidden login that could give full control, and Danfoss has released a fix. Two people told Nextgov/FCW that officials suspect Iran-linked hackers, but that is an investigative lead with no public technical evidence. The Pentagon has not confirmed that hackers caused the failures, no suspect has been named, and no link to the October attack on French supermarkets has been established. A second wave of refrigeration tampering hit supermarkets in Europe on November 2, and reporting says there is no evidence yet linking it to the US cases.
Why it matters
If confirmed, it would show the same style of attack as the French supermarkets, remote changes to everyday refrigeration controllers, against a government customer. The known Claroty flaws do not prove they were used here, so the cause is still open.
What defenders can take from it
- Take refrigeration and building controllers off the internet and apply the vendor's fixes, as in this site's patch list.
- Keep independent temperature sensors and alarms that the control system cannot switch off.
- Treat unexplained equipment failures at several sites at once as a possible cyber event, and keep the controllers' logs.