Pentagon Investigates Cyberattack on Military Base Freezers

orange and teal abstract wallpaper — Milad Fakurian / Unsplash

The United States Department of Defense is examining unusual malfunctions of freezer systems at military bases across the country that occurred in August. Officials suspect that these disruptions may be linked to a cyberattack, resulting in significant food spoilage. Investigators from the United States are coordinating with French authorities due to similarities in the attack patterns observed. Currently, US Cyber Command, alongside Army CID Cyber Field Office and law enforcement agencies, is conducting a thorough investigation into the origins and responsible parties behind this operation.

Preliminary investigations reveal that the malfunctions affected at least six base welfare stores. Technical irregularities indicate that the issues were not typical hardware failures, as the machines unexpectedly switched modes. For instance, at Fort Huachuca in Arizona, the cooling system was reportedly switched to Defrost Mode without authorization, leading to increased temperatures and total spoilage of food products. This incident mirrors a similar cyberattack in France, which caused over 350 supermarkets to experience elevated temperatures, resulting in food losses worth tens of millions of euros.

Cybersecurity experts highlight that a significant vulnerability in cooling systems arises from connecting Operational Technology (OT) control systems to the internet. In the French case, the targeted Danfoss control devices were outdated or had unpatched security vulnerabilities. Attacks on cooling systems are not a novel occurrence. Historical incidents include breaches of freezer control systems in Russia and Israel in 2022. Moreover, in late 2024, US prosecutors charged a group of hackers responsible for compromising the cooling systems of a meat processing facility, resulting in the spoilage of over 2,000 pounds of meat.

The root of these issues stems from the integration of industrial control devices, originally designed to operate independently, into external network systems for convenience without adequate security measures. This incident serves as a critical warning regarding the risks within the Food Supply Chain, as cyber threats extend beyond IT data theft to include physical control systems. Organizations reliant on Cold Storage and critical infrastructure must account for their OT equipment, segregate networks from public internet systems, and regularly check firmware settings to close security vulnerabilities.