The Pentagon is investigating a suspected cyber attack after freezer malfunctions affected at least six U.S. military bases. According to people familiar with the matter, the freezers unexpectedly switched to defrost mode, spoiling massive amounts of food overnight.
The attack mirrors a similar incident in which cold storage units at more than 350 French supermarkets malfunctioned and spoiled food. The Pentagon is working closely with French law enforcement authorities to investigate whether the incidents were related.
French-style freezer cyber attack hits numerous U.S. military bases
The cyber attack became apparent after social media posts popped up complaining that U.S. military bases had removed frozen foods from their shelves. At least six commissaries on several U.S. military bases, on-base grocery stores where military personnel buy their food, were affected.
At Fort Huachuca in Arizona, one of the affected U.S. military bases, food did not simply defrost, but heated up, spoiling overnight. The commissary directed shoppers to avoid purchasing items from certain units due to refrigeration failures.
At the Holloman AFB commissary, management posted notices telling military personnel that “all chilled and frozen merchandise” was temporarily unavailable “due to an unexpected refrigeration system failure.”
Officials who spoke on the condition of anonymity told Reuters that the Pentagon was investigating the incidents as a potential cyber attack. Several Defense Department units, including the Cyber Command, are involved in the investigation. Military investigators were also coordinating with their French counterparts to determine whether the freezer malfunctions were related to similar incidents in France.
In October 2026, freezers across more than 350 French supermarkets using outdated Danfoss technology malfunctioned, causing food losses, smoke, and fires.
However, U.S. military bases use newer technology, suggesting that the two incidents, despite their similarities, were unrelated. Nevertheless, both incidents involved internet-connected industrial control systems (ICS).
According to reports, commissaries at hundreds of U.S. military bases, including overseas installations, are centrally monitored through Refrigeration Monitoring and Control Systems (RMCS) managed by a third-party contractor. Similarly, supermarkets use remote monitoring systems to monitor their cold food storage units.
According to Steven Swift, Managing Director, Suzu Labs, “Many of these devices were never intended to be connected to the public internet. However, lots of these devices are getting connected to the internet, which suddenly makes those vulnerabilities matter.”
“Compromising industrial refrigeration systems transforms routine facility hardware into an immediate operational liability, spoiling vital food supplies and disrupting logistics across military bases,” said Damon Small, Board Member, Xcape. “While refrigeration devices may seem an unlikely target, the reality of the situation is that attackers are often opportunistic. The question we have to ask is whether these and other incidents against industrial cooling units are targeted to cause panic and damage, or if it is simply a matter of adversaries finding a new attack path.”
Food and agriculture sector targeted through operational technology
Cyber actors have previously targeted the food and agriculture sector, part of the critical infrastructure, using internet-connected industrial control systems.
“The pattern here is getting hard to miss at this point. Nichirei Logistics in Japan this summer, 700 French supermarkets through Danfoss controllers earlier this month, and now suspected activity at six U.S. military commissaries, with one freezer entering defrost mode overnight exactly like the attack in France,” said Seemant Sehgal, Founder & CEO, BreachLock.
In November 2026, malicious cyber actors targeted three British meat suppliers via vulnerable Copeland XWEB controllers, putting the cold storage units into defrost mode. The attackers exploited authentication bypass vulnerabilities to gain control.
In November 2024, a pro-Russian threat group that exploits vulnerable ICS targeted a Los Angeles meat processor, resulting in spoilage and an ammonia leak. A year before, a pro-Russian hacktivist group also targeted two dairy suppliers in the United States by exploiting industrial control systems.
In 2021, the Department of Homeland Security warned that refrigeration failures could cause food spoilage. In September 2026, the Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC) warned that the sector’s adoption of interconnected IT and operational technology (OT) had expanded the threat landscape.
