Pentagon investigates suspected hack of military commissary freezers

Suspected cyberattack on military commissaries

Pentagon officials suspect hackers targeted freezers at U.S. military commissaries in August, causing malfunctions at multiple bases. The Defense Department is treating the incidents as a potential cyberattack and coordinating with French authorities, who reported similar disruptions affecting over 350 stores earlier this month.

At least 14 freezer outages were reported across military installations in 11 states, with Reuters confirming six. Affected bases include Fort Huachuca in Arizona, Holloman Air Force Base in New Mexico, Fort Irwin in California, and Naval Station Newport in Rhode Island. Some freezers reportedly entered "defrost mode," spoiling stored food.

Vulnerabilities in industrial control systems

Security researchers at Claroty Team82 identified critical vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro freezer control systems in early August. These systems are widely used in industrial and military settings, including the U.S. military’s Remote Monitoring and Control System (RMCS), which is deployed at all 14 affected commissaries.

Industrial controllers like programmable logic controllers (PLCs) have long been used in infrastructure but were designed before modern cybersecurity risks were widely understood. This makes them vulnerable to attacks aimed at disruption or extortion, as seen in the French incidents, where some freezers reportedly caught fire.

Broader risks to food supply chains

Disrupting freezers or production facilities can render food unsafe or halt supply chains, creating broader operational risks. For example, dairy farmers cannot stop milking cows if processing facilities go offline, leading to spoilage or waste. Cybersecurity experts warn that vulnerable controllers are prime targets for threat actors seeking to exploit such dependencies.

The investigation involves multiple U.S. agencies, including Cyber Command, Army criminal investigators, and the Defense Commissary Agency (DeCA). No group has claimed responsibility for the incidents, and the Pentagon has not confirmed the cause of the malfunctions.

Earlier warnings about Danfoss vulnerabilities

This incident follows a recent report by Claroty Team82, which revealed critical flaws in Danfoss AK-SM 800A refrigeration controllers. The vulnerabilities, which included authentication bypass and command injection risks, exposed thousands of systems to remote attacks. Danfoss released a firmware update to address the issues, but the timing raises questions about whether the military’s systems were patched in time.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators in industrial technology, cybersecurity, or supply chain sectors, this incident is a stark reminder of how operational technology (OT) vulnerabilities can cascade into real-world disruptions. Military infrastructure is often assumed to be hardened, yet these freezers—part of a mundane but critical supply chain—were apparently exposed to the same risks as civilian systems.

The link to earlier vulnerabilities in Danfoss controllers suggests a lag in patching or updating legacy systems, even in high-stakes environments. Startups working on OT security or IoT hardening may find demand for solutions that bridge these gaps, particularly in sectors where downtime or spoilage translates directly into financial or operational losses.

For operators in food production, cold storage, or industrial automation, the takeaway is that cybersecurity is no longer just an IT concern. The French and U.S. incidents show that attackers are targeting physical systems where the consequences—like fires or spoiled inventory—are immediately tangible. The Pentagon’s involvement also signals that governments may ramp up scrutiny of OT security in critical supply chains.

Related on Lazyfounder

• Critical flaws in Danfoss refrigeration controllers expose thousands to remote attacks
• Danfoss
• More technology news