Pentagon probes military commissary freezer failures as suspected cyberattack

The US Department of Defense is investigating a series of refrigeration failures at military commissaries, the grocery stores on American bases, as a suspected cyberattack, according to reports first published on Thursday, October 29, 2026. At least six commissaries reported that cooling units and freezers had unexpectedly switched into defrost or heating mode overnight in late August, melting and spoiling large amounts of food, and some reports say the faults also caused fires. The Army Criminal Investigation Division's Cyber Field Office, the Defense Commissary Agency and the Defense Criminal Investigative Service are handling the military commissary refrigeration cyberattack probe, and investigators are in contact with French authorities about a similar attack on commercial freezers in France earlier in October. No one has publicly confirmed a hack or named a suspect.

Most people think of cyberattacks as stolen passwords, locked computer files or leaked data. This case, if confirmed, is a different kind: an attack on physical equipment. Modern commercial fridges and freezers are often run by networked controllers, small computers that set temperatures and defrost cycles and can be monitored or adjusted remotely. That convenience creates a risk. If an attacker can reach the controller, they can change its settings, and the damage happens in the real world: food spoils, equipment overheats and, in the worst case, fires start.

The pattern is what makes investigators suspicious. Several stores at bases far apart reported the same odd behaviour, with units switching to defrost or heating overnight, at around the same time. A similar attack on commercial freezers in France in October adds to the concern that someone may be targeting a particular type of refrigeration control system. Records for at least one commissary, at Naval Air Facility El Centro in California, list a control system made by Danfoss, though reports have not said whether that equipment was involved in any of the failures.

The military angle raises the stakes. Commissaries feed service members and their families, and a deliberate attack on food supplies at several bases would be a serious security matter, even if no weapons system was touched. It is also a reminder for every business that runs connected equipment, from supermarkets and restaurants to hospitals and cold-chain warehouses, that these devices need the same security care as office computers.

The investigation is still open. Officials have not said how far it has progressed, whether anyone actually gained access to the commissaries' systems, or who might be responsible. Until they do, the cause should be treated as suspected, not proven.

Short-term: Commissaries are likely to check and isolate the network connections of their refrigeration controls, and equipment makers and operators may be asked to review security settings. Large quantities of food were already lost at the affected stores.

Long-term: If the probe confirms an attack, it could lead to stricter security rules for networked building and refrigeration equipment on US bases and beyond, and closer international cooperation on attacks against such systems.

Who is affected: Service members and families who shop at commissaries, the Defense Commissary Agency, makers of commercial refrigeration controls, and businesses everywhere that rely on connected cooling equipment.

Questions and Answers