Pentagon suspects hackers behind freezer failures at US base stores

The Pentagon is investigating whether hackers caused freezers to fail at shops on US military bases in August, after a similar attack hit hundreds of supermarkets in France this month.

Four officials told Reuters on Thursday that investigators are treating the US incidents as a suspected cyberattack. One official said they had also spoken to French police about the more recent case.

The US problems began in late August, when refrigerators and freezers at military commissaries, the food shops on US bases, switched to defrost mode and warmed up, spoiling food.

At least six bases reported problems, including Fort Huachuca in Arizona and Fort Irwin in California, Stars and Stripes reported.

At the time, the Pentagon confirmed that some commissaries had experienced refrigeration problems but did not give a cause, Military Times reported.

Army and Air Force investigators, including an Army cybercrime unit, began looking into the failures soon afterwards. US Cyber Command, the military’s cyber operations arm, has since joined the investigation.

The Pentagon told Reuters that its team was “working in close coordination with interagency and law enforcement partners.”

The French incidents offer investigators a possible lead. In mid-October, attackers reportedly changed the settings on refrigeration systems at hundreds of supermarkets, causing them to defrost overnight.

Temperatures inside some units climbed to around 50°C. About 150 Intermarché stores and nearly 100 Super U shops were affected, according to TNW’s earlier report.

Many of the French stores used control boxes made by Danish refrigeration company Danfoss. The company told Reuters that many of the affected units were old or running outdated software. It did not respond to the news agency’s questions about the US incidents.

Reuters could not establish whether the military commissaries used Danfoss equipment. However, records for at least one shop, at Naval Air Facility El Centro in California, list a Danfoss control system.

There is also a potential security concern involving the company’s equipment. In August, cybersecurity firm Claroty reported vulnerabilities in refrigeration controls made by Danfoss and Copeland. The flaws included a hidden login that could allow an attacker to take full control of a system. Danfoss has since released a fix.

The vulnerabilities do not establish that they were used in either incident. The Pentagon has not confirmed that anyone gained access to the commissary systems or explained what caused the failures.

The military agency responsible for the shops operates 235 commissaries worldwide. Investigators have yet to say whether the suspected attack affected systems beyond the stores where the refrigeration failures were reported.