Pentagon probes US military base freezer malfunction as suspected cyberattack

The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.

One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.

Reuters was not able to ascertain how far along the Pentagon's investigation was or whether it had reached any conclusions about what happened or who might be responsible. When asked about the investigation, the Pentagon said that a unit of Cyber Command — the military's cyber force — was "working in close coordination with interagency and law enforcement partners." It did not elaborate.

The US Army Criminal Investigation Division said its Cyber Field Office was involved in the investigation and that it was working with French law enforcement to better understand "the refrigeration outages in Europe."

The late August malfunctions in the United States affected at least six commissaries — on-base stores where military personnel buy their food — according to a Reuters review of the military bases' contemporaneous Facebook posts and website updates. In at least one of the cases, the freezers did not simply stop working; the cooling units' temperatures were cranked up overnight, yielding mounds of wilted or melted food in the morning.

The Fort Huachuca, Arizona, Facebook account explained on August 26 that its freezer "went into defrost mode where it heated up all the food. Trust us when we say it was 'spoiled.'"

The spate of rogue freezer behavior and the possibility of cybersabotage were first reported on August 28 by a recently created blog called Signal and Silence. The involvement of military investigators and their contacts with the French were reported by the newspaper Stars and Stripes and Britain's Daily Telegraph, respectively. The news that the investigators were treating the incident as a suspected hack is being reported here for the first time.

The French Embassy in Washington did not return a message seeking comment.

FRENCH FREEZERS FRIED

If confirmed to be a cyberattack, the refrigerator malfunctions would be another illustration of how vulnerable critical infrastructure — in this case cold storage — can be to hackers.

The French freezer cyberattack overrode the temperature controls on commercial cooling units in more than 350 establishments, leading to dramatic scenes as supermarkets' frozen food aisles were cleared of spoiled merchandise.

The French hack involved cranking the temperature inside the units up rather than merely knocking them offline, similar to what happened in Fort Huachuca in Arizona. Some French refrigeration units had the temperature turned up so high they caught fire. The French attack's total costs could add up to tens of millions of euros nationwide, one supermarket owner estimated earlier this month.

The French cyberattack appeared to have ​been easy to pull off, experts previously told Reuters. The Danish firm Danfoss, whose controllers ran made many of the stricken units, said that many of the controllers were obsolete or were running outdated firmware, which could have made it easy for hackers to break in. Reuters could not establish whether Danfoss or any other brand of freezer controller were in use at the affected US bases. Danfoss did not return messages seeking comment.

CHILLING HACKS

Refrigeration plays a critical role in the distribution of fresh food and the sabotage of cold storage facilities over the internet has long been seen as a nightmare scenario, alongside the loss of electricity or water plants.

Earlier this year, the Global Food Safety Initiative, an industry body, called on food safety professionals and IT leaders to work together to ensure "robust cybersecurity" for refrigeration technology, noting that "a hacked cooling system is just as dangerous as a broken one."

Hackers have previously sabotaged fridges and freezers both in the United States and elsewhere.

Danfoss has said that, in 2022, hackers either targeted or broke into supermarkets in Russia and Israel that were using obsolete versions of its cold storage controllers. In December of last year, federal prosecutors in Los Angeles accused a Ukrainian woman of being part of a hacker group that knocked out the refrigeration at a meatpacking facility in 2024, ruining more than 2,000 pounds of meat.

The root problem was that controllers that were initially conceived as isolated interfaces that would be serviced by an in-person technician were increasingly being connected to the internet, said Bill Moore, the chief executive of industrial cybersecurity firm Xona Systems. Concerns about online exposure were not unique to cooling systems, he said, but they could have particularly serious consequences there.

"It can definitely disrupt the supply chain for food," he said.