It is not confirmed that hackers caused the freezer failures at US military commissaries, but the Pentagon is treating them as a suspected cyberattack, four officials told Reuters (Reuters via Military Times). The Defense Department has not publicly said that hackers were responsible (Task & Purpose). On 2 November, Nextgov/FCW reported for Defense One that US officials suspect hackers linked to Iran. The report cites two unnamed people familiar with the matter, and no official has confirmed it on the record (Defense One).
What happened at the bases
In late August, refrigeration at at least six commissaries, the on-base grocery stores used by service members and their families, malfunctioned, according to Reuters’ review of base Facebook posts and website updates (Reuters via Military Times). Military Times has documented outages at seven Army, Navy and Air Force installations, and some stores were temporarily unable to sell refrigerated or frozen food (Task & Purpose).
In at least one case cooling units were turned up overnight. At Fort Huachuca in Arizona, the installation said on 26 August that its freezer had gone into defrost mode and heated up all the food (Reuters via Military Times).
Who is investigating
- The Defense Criminal Investigative Service leads a joint investigation; a Defense Department official said the department is “aware of speculation regarding a potential cyber incident” (Task & Purpose).
- Army CID says it is working with the Defense Commissary Agency, DCIS and French law enforcement (Task & Purpose).
- A Cyber Command unit said it was working with interagency and law enforcement partners (Reuters via Military Times).
The supermarket attacks in France and across Europe
The US inquiry follows a confirmed cyberattack in France earlier in October. Attackers overrode temperature controls on cooling units in more than 350 establishments, emptying frozen aisles of spoiled food, and some units caught fire (Reuters via Military Times). France’s finance minister told parliament on 13 October that about 700 of the country’s 10,000 supermarkets were affected (AP via ClickOnDetroit). CNN reported that the hackers remotely triggered defrost cycles (Task & Purpose).
The attacks have since spread beyond France. On Monday 2 November, retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported fridge and freezer temperatures rising as high as 50C (The Guardian via AOL). Ahold Delhaize said units in dozens of its supermarkets in Belgium and Luxembourg were hit, Colruyt reported problems in five shops, and in Ireland SuperValu said 13 of its 223 shops were affected (The Guardian via AOL). NPR also reports stores hit in early November in countries including Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium (NPR via WFAE). Carrefour Belgium and Ikea Belgium said the cause was a cyber-attack; no group has claimed responsibility (The Guardian via AOL).
Danfoss, whose controllers ran many of the French units, said many of the devices were obsolete or ran outdated firmware (Reuters via Military Times). NPR reported on 3 November that public contracting documents show several Defense Commissary installations, including Fort Irwin and Fort Huachuca, both of which have disclosed outages, run Danfoss refrigeration remote-control systems. Some are older controllers from the mid-2000s that can no longer be updated with secure software (NPR via WFAE). That links the equipment, not the cause: the Pentagon has still not said whether hackers were responsible (NPR via WFAE).
Why it matters
For military families, lost stock means shopping off base, often at higher prices, said Wes Bryant, a former Air Force special operations member who worked on civilian harm assessments at the Pentagon. He also pointed to readiness: “A lot of troops won’t work with no access to food” (Task & Purpose).
What we don’t know
Investigators have not publicly said who is behind the outages or how far the inquiry has got (Reuters via Military Times). The suspected Iran link comes from two anonymous sources, not from an official statement. Defense One’s report says the attribution would show Iran can disrupt military-related equipment only “if fully confirmed”, and that assessments may change as investigators learn more. The same report dates the intrusions to around late August and says it is unclear how the intruders got into the freezer systems (Defense One). Nacionale could not independently confirm the attribution. Some bases use the same make of controller as the French stores, but no published evidence shows that the base outages and the attacks in Europe had the same cause. The full list of affected bases has not been released.
