Pentagon Treats August Freezer Failures at Military Commissaries as Suspected Cyberattack, Four Officials Say

Since a base Facebook page posted on Aug. 26 that every freezer at the Fort Huachuca commissary had spoiled its food, the U.S. military has gone from silence to a joint criminal investigation. On Thursday, Oct. 29, four officials told Reuters the Pentagon is treating the August freezer failures as a suspected cyberattack.

The Defense Department had already acknowledged the probe in a statement. "We are aware of speculation regarding a potential cyber incident," it said. The Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon's Office of Inspector General, is "leading a joint investigation." The department added that it does not comment on ongoing law enforcement investigations.

What happened at the bases

At least six commissaries, the on-base grocery stores where service members buy food, reported refrigeration trouble in late August. Reuters' review of base Facebook posts and website updates put Fort Huachuca in Arizona, Fort Irwin and Travis Air Force Base in California, F.E. Warren Air Force Base in Wyoming, Naval Station Newport in Rhode Island, and Columbus Air Force Base in Mississippi on the list.

Fort Huachuca's Aug. 26 post said its freezers "went into defrost mode," and added: "ALL frozen food has spoiled." In at least one case, the cooling units did not simply quit. Temperatures were pushed up overnight, and staff found melted food in the morning.

Fort Irwin limited commissary sales to dry goods after its outage.

The possibility of sabotage first surfaced Aug. 28 on a newly created blog called Signal and Silence. Military investigators' involvement and their contact with French authorities were later reported by Stars and Stripes and The Telegraph.

The French connection

In October, hackers overrode temperature controls on commercial refrigeration at more than 350 establishments in France. Photos from Intermarché stores date the outage to about Oct. 12. Units were driven to roughly 50°C (122°F), spoiling food. Some caught fire.

Affected chains included Carrefour, Monoprix, Intermarché, E.Leclerc and Coopérative U. The Paris prosecutor's office called it a "large-scale" attack. Dominique Schelcher, president of Coopérative U, called the situation "extremely serious."

The local outlet Sud Ouest put combined stock damage at two stores, Intermarché and E.Leclerc, at about €270,000 ($300,000). One supermarket owner estimated nationwide costs could reach tens of millions of euros.

The U.S. Army Criminal Investigation Division said its Cyber Field Office is part of the U.S. probe and is working with French law enforcement "to better understand the refrigeration outages in Europe." A Fox News inquiry drew confirmation from an Army CID spokesperson that the office is also working with the Defense Commissary Agency and DCIS. A unit of Cyber Command is coordinating with interagency partners, the Pentagon said. The French Embassy in Washington declined to comment.

The Danfoss question

Many of the French stores used refrigeration controllers made by Danish manufacturer Danfoss. The company told Reuters that many of those controllers were old or running outdated software.

In August, the cybersecurity firm Claroty reported vulnerabilities in controllers from Danfoss and Copeland, including a hidden login that could let an attacker take control of a system. Danfoss has since released a fix. Records for at least one commissary, at Naval Air Facility El Centro in California, list a Danfoss control system.

No official has said the U.S. outages involved that flaw, or that any Danfoss device was involved at the six affected bases. Danfoss did not respond to Reuters' questions about the U.S. incidents.

Suspicion versus proof

Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, told Fortune: "You'd be silly not to be suspicious." The same kind of target suffered the same kind of outage within about two months, he noted.

That is a reason to investigate, not a finding. The Pentagon has not announced a conclusion, has not named a suspect, and has not said whether the French and U.S. incidents are linked. Fort Huachuca itself described a defrost-mode failure, a symptom that a cyber intrusion and a plain equipment fault could both produce. The investigators have not publicly ruled out either.

Whyte's argument for why the target matters is blunt. "You can't unspoil food or other products from these freezers," he said. "It's just Euros and dollars down the drain."

A known risk

The risk is not new. A 2021 Department of Homeland Security assessment of threats to food and agriculture named refrigeration failures and shipping delays as cybersecurity risks that could cause spoilage and shortages.

The Food and Agriculture Information Sharing and Analysis Center, an industry group, has warned that attackers are going after internet-accessible industrial controls that may be poorly defended. It also said the sector's sensitivity to downtime often gives ransomware groups leverage to demand payment.

A bipartisan group in Congress reintroduced the Farm and Food Cybersecurity Act in 2025, after an earlier version in 2024. It has not been reported as law.

The open question for investigators is whether a single actor or method ties the August commissary outages to the October French attack. DCIS, Army CID and Cyber Command have not said when they expect to answer it.