Pentagon Cyber Investigators Probe Military Freezer Failures After Supermarket Attacks
A joint inquiry into August freezer malfunctions at U.S. military commissaries is being spearheaded by the Pentagon’s criminal investigators, who are treating these equipment breakdowns as potential cyberattacks. Four officials confirmed the ongoing federal inquiry to Reuters, which comes weeks after hackers took over the refrigeration controls at hundreds of French supermarkets overnight.
The disruptions hit more than half a dozen U.S. military commissaries in August. Affected locations included Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island, Little Rock Air Force Base in Arkansas, F.E. Warren Air Force Base in Wyoming, Robins Air Force Base in Georgia, and Fort Huachuca in Arizona, as reported by the Military Times. Commissaries typically provide subsidized goods to those living on military bases, costing about 25% less than civilian grocery stores. The possibility that the outages were a result of a hack was first reported by the Substack Signal and Silence.
Defense Criminal Investigative Service Leads Joint Inquiry
The outages are the subject of a joint investigation steered by the Defense Criminal Investigative Service, which functions as the criminal investigative arm within the agency’s Office of Inspector General. The agency declined to discuss specifics of the case. “For security reasons, we do not comment on ongoing law enforcement investigations,” the Pentagon stated to Fortune.
August saw a string of refrigerator outages across multiple U.S. military commissaries, which preceded a joint effort between the Pentagon and French authorities to examine the supermarket disruptions in France. In France, hackers targeted hundreds of supermarkets, raising the temperature of their refrigeration and freezer systems overnight to more than 122 degrees Fahrenheit, spoiling food and causing fires. The affected grocery stores included 80 Carrefour locations, about two-dozen Monoprix stores, and 150 Intermarche stores. The Paris prosecutor’s office called the outages a “large-scale” attack. Local French news outlet Sud Ouest reported that two supermarket brands, Intermarché and E.Leclerc, reported an estimated €270,000, about $300,000 in combined stock damages.
Vulnerabilities in Commercial Refrigeration Firmware
French authorities published an alert bulletin detailing how the European supermarket breaches occurred. Hackers were able to exploit affected units via internet access because these devices ran outdated firmware, with the security flaws stemming from access to Danish-built Danfoss AK-SM and AK-SC series remote controllers for refrigeration systems, alongside Copeland xweb and Dixell xweb units.
“Refrigerators give an attacker a weirdly direct route…to financial loss that’s, with cyber, unusually irreversible,” said Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, in an interview with Fortune. “You can’t unspoil food or other products from these freezers. It’s just Euros and dollars down the drain.”
At this point, concrete evidence is lacking to link the two incidents or to confirm that the commissary malfunctions stemmed from a hack. Nonetheless, the occurrence of identical malfunctions in matching target types separated by roughly two months proved sufficient to capture Christopher Whyte’s attention. “You’d be silly not to be suspicious,” he told Fortune.
Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, told Fortune that networked appliances often prioritize advanced features over fundamental cybersecurity. “A lot of these devices have a lot of really cool features, but the security is not the first priority for them,” Kostyuk said. “Hopefully future inventions will come with more security in mind when it comes to the design, and the existing ones also will be revisited to incorporate all the potential vectors of the cyberattacks.”
Global Cyber Threats and Military Supply Chain Risks
The investigation unfolds against a backdrop of escalating digital threats against both corporate infrastructure and government bodies. The Center for Strategic and International Studies recorded more than a dozen major cyber attacks during September alone. Meanwhile, Cybersecurity Ventures projects that global cybercrime will cost the economy $10.8 trillion this year, more than triple the $3 trillion it cost in 2015, driven by sophisticated artificial intelligence tools and an ever-expanding number of internet-connected appliances.
State-sponsored actors belonging to North Korea, Iran, China, and Russia frequently deploy seemingly random cyber incidents that possess underlying connections, as explained to Fortune by University of Maryland, Baltimore County international relations and cybersecurity assistant professor Gregory Winger. Dedicated partnerships have been established among allied nations specifically to uncover and distribute hacker methodologies, most notably through NATO’s primary cybersecurity hub, Supreme Headquarters Allied Powers Europe (SHAPE), located in Mons, Belgium. Major cyber assaults can prompt the activation of NATO’s Article 5, establishing a collective defense framework where an attack on any single nation is treated as an aggression against all 32 member states. Winger argued that launching a joint U.S.-French investigation makes strategic sense from an information-sharing perspective regardless of whether the same perpetrator carried out both attacks.
“Right now,” Winger said, “every future military operation is going to have a cyber component to it.”
Frequently Asked Questions About the Commissary Probe
Which military bases experienced commissary freezer outages in August?
More than a half-dozen military bases reported disruptions, including Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island, Little Rock Air Force Base in Arkansas, F.E. Warren Air Force Base in Wyoming, Robins Air Force Base in Georgia, and Fort Huachuca in Arizona, according to the Military Times.
Which specific hardware controllers were compromised in the European supermarket attacks?
Internet-accessible units running obsolete firmware were compromised via security flaws in Copeland xweb, Dixell xweb, and Danish-manufactured Danfoss AK-SM and AK-SC series refrigeration remote controllers, according to French authorities.
What financial losses have stores reported from the refrigeration tampering?
Local French news outlet Sud Ouest reported that two supermarket chains, Intermarché and E.Leclerc, reported an estimated €270,000, about $300,000 in combined stock damages.
Related reading