Commissary freezer failures: was it a hack? What’s known so far

The commissary freezer failures began in late August, when several on-base grocery stores reported within days of each other that their refrigerators and freezers had stopped working properly. Some units went into defrost mode and warmed up, which meant meat, dairy, produce and frozen goods had to be thrown out. Stores stayed open but could only sell dry goods for a while.

Bases that posted public notices about the problem include:

• Fort Huachuca in Arizona, which said on Aug. 26 that its freezer had heated all the food and that it really was spoiled
• Travis Air Force Base and Fort Irwin in California
• Columbus Air Force Base in Mississippi
• Naval Station Newport in Rhode Island
• F.E. Warren Air Force Base in Wyoming

A seventh site, Naval Air Station Lemoore in California, was also reported to have had an outage, and one military newspaper has counted outages at seven Army, Navy and Air Force installations. Early, unverified claims put the number as high as a dozen stores. Fort Irwin later said its freezer repairs were done and that emergency food orders should restock shelves within 48 hours.

The Defense Commissary Agency, which runs 235 of these stores worldwide, sent questions to the Pentagon. For families who rely on commissaries for cheaper groceries, a week of empty freezer cases means paying more at stores off base.

No one has publicly confirmed that hackers caused the commissary outages. That’s the most important thing to keep straight while the headlines get louder.

Here’s what is on the record:

• The Defense Criminal Investigative Service (DCIS), the criminal arm of the Defense Department’s Office of Inspector General, is leading a joint investigation.
• Army CID’s Cyber Field Office, which handles computer intrusions and insider threats, is involved, along with the Air Force Office of Special Investigations.
• US Cyber Command has joined in, coordinating with law enforcement and other federal agencies.
• A Defense Department official acknowledged the speculation about a cyber incident but said the department won’t discuss an open case, citing security.

The suspected-cyberattack framing comes from a Reuters report citing four officials familiar with the matter. It is still unclear who might be responsible, or whether investigators have actually ruled out a plain equipment fault. Officials didn’t answer direct questions about whether anyone gained unauthorized access to commissary systems.

So the honest answer today is: it’s being treated as a possible hack by people who would know, but it hasn’t been proven.

The US probe picked up speed after a confirmed attack in France in early October. Hackers took over refrigeration controls at more than 350 French establishments, including about 150 Intermarché stores and nearly 100 Super U locations, and set off defrost cycles that pushed some units to around 50 degrees Celsius (122 degrees Fahrenheit). Some estimates put the total closer to 700 supermarkets. In a few stores, overheated equipment caught fire.

The pattern looks a lot like Fort Huachuca, where freezers entered defrost mode overnight. Army investigators say they are now working with French law enforcement to understand the European outages, and US officials had already contacted French police about the October incident.

There’s one more thread. Many of the affected French stores used controllers made by Danish company Danfoss, and paperwork for the El Centro naval air facility’s commissary in California shows a Danfoss control system there. Investigators haven’t said whether any flaw in that equipment played a role in the US cases.

A modern supermarket doesn’t run each freezer by hand. A central controller manages the whole fleet of cases, and many of these boxes are hooked up to the internet so a technician can adjust settings remotely instead of driving out. That convenience is the weak spot.

These controllers were often designed as isolated panels that a technician would service in person, then later connected to networks they were never built to face. France’s cyber agency, ANSSI, said the October attacks exploited basic failures such as weak passwords and missing defenses.

The specific flaws are worse than weak passwords. In August, the security firm Claroty reported holes in Danfoss and Copeland refrigeration controllers, including a hidden login that could hand an attacker control. Older Danfoss units used a daily password generated from the date by firmware anyone could download, so the same password worked on matching models in many stores. Danfoss has since issued a fix, and told Reuters that many of the French controllers were old or running outdated software.

Food systems have been flagged for this before. A 2021 Department of Homeland Security assessment named refrigeration failures as a cyber risk that could cause spoilage and shortages, and a food-industry threat-sharing group has warned that attackers are probing internet-facing industrial controls with weak protection.

If you shop at a commissary, there’s nothing for you to do about your own devices. The risk here is to store equipment, not to your phone or bank card, and there’s no sign that customer data was involved. The practical effect is empty freezer shelves for a few days and higher grocery bills elsewhere if it happens again.

For military families, the stakes run higher than inconvenience. Former Air Force special operations member Wes Bryant called food supply the military’s “Achilles’ heel”, noting that troops at home and abroad depend on regular fresh food rather than living on field rations.

If you run a store, restaurant or warehouse with networked refrigeration, the lesson from France is simple and cheap to act on:

1. Ask your refrigeration vendor or service company which controller models you have and whether their firmware is current.
2. Take controllers off the open internet, or put them behind a VPN or a vendor’s secure remote-access service.
3. Change any default or shared passwords, and remove old remote logins you don’t use.
4. Set temperature alarms to alert a person by phone, so a forced defrost gets noticed in minutes, not hours.