Pentagon Investigates Whether Hackers Spoiled Commissary Food at Army, Navy and Air Force Bases - Military.com

The Defense Criminal Investigative Service (DCIS) is leading a joint investigation with Army criminal investigators and the Defense Commissary Agency (DeCA) into suspected cyberattacks that caused refrigeration failures at military commissaries in August. The disruptions left military families with limited access to perishable foods as stores were forced to restrict sales to dry goods only.

The failures affected installations across several states, including Fort Irwin, Calif.; Fort Huachuca, Ariz.; Naval Station Newport, R.I.; and Holloman, Little Rock, F.E. Warren and Robins Air Force bases. At Fort Huachuca, officials described an overnight failure that sent every freezer into defrost mode, resulting in all frozen food spoiling.

European Connections

Army investigators have confirmed they are working with French law enforcement to understand refrigeration outages in Europe. This cooperation follows confirmed attacks on French supermarket refrigeration systems in October. France's national cybersecurity response team issued an alert identifying compromises of Danfoss AK-SM and AK-SC refrigeration controllers and Copeland and Dixell XWEB systems.

Financial Impact

Commissaries offer military families at least 25% overall savings compared with civilian supermarkets. When refrigeration failures force stores to sell only dry goods, families must buy milk, eggs, meat and other perishables elsewhere, potentially increasing their grocery bills and adding pressure to household budgets.

Infrastructure Concerns

The investigation comes as the Pentagon pursues its FORTRESS initiative, which aims for major U.S. installations to sustain essential operations for at least 90 days without outside support. The commissary failures highlight a vulnerability: stockpiling food offers limited protection if the equipment preserving it can be disabled.

A 2015 GAO review warned that disruptions to installation utilities could threaten military missions and found shortcomings in Defense Department cybersecurity implementation for industrial control systems. The French guidance recommended removing controllers from the public internet, checking configurations, updating firmware, and restoring remote access only through secured networks.