Pentagon Probing Freezer Failures at Multiple Military Outposts

The integrity of critical food supply infrastructure is now a potential cyber warfare target.

The Pentagon is investigating multiple freezer malfunctions at U.S. military base commissaries that occurred in late August, suspecting a cyberattack. At least six commissaries across the United States were affected. In one instance, a freezer was intentionally heated overnight, spoiling its contents. U.S. investigators are collaborating with French authorities regarding a similar, large-scale cyberattack that impacted over 350 commercial freezer units in France earlier in October. That French attack, reportedly targeting refrigeration controls made by Danfoss, caused significant damage, with some units catching fire and estimated losses in the tens of millions of euros. The U.S. Army Criminal Investigation Division's Cyber Field Office and a unit of U.S. Cyber Command are involved in the U.S. investigation and are coordinating with international law enforcement.

This incident signals a growing vulnerability in essential infrastructure systems, extending beyond typical IT networks to operational technology (OT) like refrigeration units. The parallel attacks in France and the U.S. suggest a potential coordinated effort or the exploitation of common vulnerabilities in commercial refrigeration systems, possibly targeting specific hardware manufacturers like Danfoss. The use of cyberattacks to disrupt physical supply chains, causing spoilage and financial damage, indicates a new dimension in hybrid warfare tactics.

The involvement of U.S. Cyber Command and international law enforcement highlights the seriousness with which these attacks are being viewed. The investigation's focus on potentially outdated firmware in refrigeration controls suggests a need for enhanced cybersecurity protocols and regular updates for OT systems in both military and commercial sectors. Future attacks could target other critical infrastructure components if these vulnerabilities are not adequately addressed.