Pentagon Probes Freezer Failures at U.S. Military Commissaries Amid Possible Hack
The Pentagon is investigating August refrigeration outages at U.S. military commissaries as a possible cyberattack, weeks after hackers disrupted hundreds of French supermarkets.
The Pentagon is treating a series of freezer failures at U.S. military commissaries as a possible cyberattack, according to four officials who spoke to Reuters. The Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon's Office of Inspector General, is leading a joint probe into the August outages. The investigation comes weeks after hackers took over refrigeration controls at hundreds of French supermarkets overnight.
There is no proof yet that the two incidents are connected, or that the commissary failures were caused by a hack at all. Still, the similarities have drawn attention. Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, said the timing and target type are enough to warrant suspicion. « You'd be silly not to be suspicious, » he told Fortune.
The French attacks caused direct financial losses. Earlier this month, hackers raised the temperature of refrigeration and freezer systems at hundreds of supermarkets to more than 122 degrees Fahrenheit, spoiling food and in some cases causing fires. The affected stores included 80 Carrefour locations, about two dozen Monoprix stores, and 150 Intermarché stores. The Paris prosecutor's office described the outages as a « large-scale » attack, and similar disruptions were reported across Europe. Two supermarket chains, Intermarché and E.Leclerc, reported an estimated €270,000, about $300,000, in combined stock damage, according to the local outlet Sud Ouest.
Whyte said refrigeration systems offer attackers a direct route to financial harm that is especially hard to reverse. « You can't unspoil food or other products from these freezers, » he said. « It's just Euros and dollars down the drain. » The U.S. outages were reported in August across more than a half-dozen commissaries, including sites at Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island, Little Rock Air Force Base in Arkansas, F.E. Warren Air Force Base in Wyoming, Robins Air Force Base in Georgia, and Fort Huachuca in Arizona, according to Military Times. Commissaries sell subsidized goods to people living on military bases, at prices about 25% below civilian grocery stores.
The Substack Signal and Silence was among the first to raise the possibility that the U.S. outages were the result of a hack. The Pentagon confirmed the investigation but declined to provide details. In a statement to Fortune, it said, « For security reasons, we do not comment on ongoing law enforcement investigations. »
The concern reflects a broader rise in cyber incidents. The Center for Strategic and International Studies counted more than a dozen major attacks in September alone. Cybercrime is projected to cost the global economy $10.8 trillion this year, according to Cybersecurity Ventures, more than triple the $3 trillion it cost in 2015. Rapidly developing artificial intelligence has made hacking more sophisticated, while the growing number of internet-connected appliances has multiplied potential targets.
Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, said she was surprised it took this long for appliances such as refrigerators to become targets. « A lot of these devices have a lot of really cool features, but the security is not the first priority for them, » she told Fortune. She added that she hoped future designs would build in security from the start and that existing devices would be reviewed for potential attack routes.
In the French case, the vulnerabilities involved remote controllers for refrigeration systems, including Danish-made Danfoss AK-SM and AK-SC series units, as well as Copeland xweb and Dixell xweb devices, according to an alert bulletin from French authorities. The affected units ran outdated firmware that attackers could exploit by reaching the devices over the internet. Whyte noted that many refrigeration systems are similar across commercial chains, meaning a weakness found in one system can be generalized to others.
6
