Key Takeaways
- • The Pentagon's Defense Criminal Investigative Service is leading a joint probe into freezer failures at U.S. military commissaries in August, and four officials told Reuters the Pentagon is treating the outages as a possible cyberattack.
- • Hackers raised refrigeration and freezer temperatures at hundreds of French supermarkets overnight to more than 122 degrees Fahrenheit, affecting 80 Carrefour, about two dozen Monoprix and 150 Intermarché stores, according to the report.
- • Intermarché and E.Leclerc reported combined stock damages of an estimated €270,000 (about $300,000), according to local outlet Sud Ouest.
- • More than a half-dozen U.S. commissaries, including sites at Fort Irwin, Holloman AFB, Naval Station Newport and Robins AFB, experienced refrigeration failures in August, but there is no confirmed link to the French attacks.
- • Experts say refrigeration controllers are attractive targets because of shared commercial designs and outdated firmware, and the Pentagon's joint investigation with France is seen as valuable for information sharing.
Summary
The Pentagon's criminal investigators are leading a joint probe into freezer failures at U.S. military commissaries in August, and four officials told Reuters that the Pentagon is treating the incidents as a possible cyberattack. The Pentagon confirmed that the Defense Criminal Investigative Service, the criminal investigative arm of the agency's Office of Inspector General, is leading the investigation, but said in a statement to Fortune, "For security reasons, we do not comment on ongoing law enforcement investigations." There is no proof yet that the U.S. outages and recent French incidents are connected, or that the commissary failures were caused by hacking at all.
The probe follows an attack on hundreds of French supermarkets earlier in the month, when hackers overnight pushed refrigeration and freezer systems above 122 degrees Fahrenheit, spoiling food and causing fires. Affected chains included 80 Carrefour locations, about two dozen Monoprix stores and 150 Intermarché stores. The Paris prosecutor's office described the outages as a "large-scale" attack, and similar outages were reported across Europe. Intermarché and E.Leclerc reported an estimated €270,000 (about $300,000) in combined stock damages, according to Sud Ouest. According to French authorities' alert bulletin, the vulnerabilities involved Danish-made Danfoss AK-SM and AK-SC series remote controllers, as well as Copeland xweb and Dixell xweb units running outdated firmware that could be accessed over the internet.
At U.S. bases, more than a half-dozen commissaries were affected in August, including those at Fort Irwin, California; Holloman Air Force Base, New Mexico; Naval Station Newport, Rhode Island; Little Rock Air Force Base, Arkansas; F.E. Warren Air Force Base, Wyoming; Robins Air Force Base, Georgia; and Fort Huachuca, Arizona, according to Military Times. Commissaries sell subsidized goods to personnel living on bases, at about 25% below civilian grocery prices. The Substack Signal and Silence was first to raise the possibility of a hack. Christopher Whyte of Virginia Commonwealth University said, "You'd be silly not to be suspicious," and noted that refrigeration offers attackers a direct route to financial loss that is largely irreversible.
Experts cited broader concerns. Nadiya Kostyuk of Carnegie Mellon said security is often not the priority in connected devices, and Whyte said similar commercial refrigeration equipment means an exposure in one system can be generalized to others. Gregory Winger of UMBC said the U.S. was strategic to launch a joint investigation with France for information-sharing purposes, regardless of whether the incidents share an actor. Winger added, "Right now, every future military operation is going to have a cyber component to it." According to the Center for Strategic and International Studies, there were more than a dozen major cyberattacks in September alone, and Cybersecurity Ventures projects cybercrime will cost the global economy $10.8 trillion this year.
The probe follows an attack on hundreds of French supermarkets earlier in the month, when hackers overnight pushed refrigeration and freezer systems above 122 degrees Fahrenheit, spoiling food and causing fires. Affected chains included 80 Carrefour locations, about two dozen Monoprix stores and 150 Intermarché stores. The Paris prosecutor's office described the outages as a "large-scale" attack, and similar outages were reported across Europe. Intermarché and E.Leclerc reported an estimated €270,000 (about $300,000) in combined stock damages, according to Sud Ouest. According to French authorities' alert bulletin, the vulnerabilities involved Danish-made Danfoss AK-SM and AK-SC series remote controllers, as well as Copeland xweb and Dixell xweb units running outdated firmware that could be accessed over the internet.
At U.S. bases, more than a half-dozen commissaries were affected in August, including those at Fort Irwin, California; Holloman Air Force Base, New Mexico; Naval Station Newport, Rhode Island; Little Rock Air Force Base, Arkansas; F.E. Warren Air Force Base, Wyoming; Robins Air Force Base, Georgia; and Fort Huachuca, Arizona, according to Military Times. Commissaries sell subsidized goods to personnel living on bases, at about 25% below civilian grocery prices. The Substack Signal and Silence was first to raise the possibility of a hack. Christopher Whyte of Virginia Commonwealth University said, "You'd be silly not to be suspicious," and noted that refrigeration offers attackers a direct route to financial loss that is largely irreversible.
Experts cited broader concerns. Nadiya Kostyuk of Carnegie Mellon said security is often not the priority in connected devices, and Whyte said similar commercial refrigeration equipment means an exposure in one system can be generalized to others. Gregory Winger of UMBC said the U.S. was strategic to launch a joint investigation with France for information-sharing purposes, regardless of whether the incidents share an actor. Winger added, "Right now, every future military operation is going to have a cyber component to it." According to the Center for Strategic and International Studies, there were more than a dozen major cyberattacks in September alone, and Cybersecurity Ventures projects cybercrime will cost the global economy $10.8 trillion this year.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.