The Pentagon is investigating whether hackers caused a string of freezer failures that spoiled food at U.S. military base stores in August, Reuters reported Thursday, citing four officials familiar with the matter. The Pentagon has not confirmed that anyone gained access to the systems involved, and the cause remains unexplained.

What we know

• At least six commissaries were affected. Base announcements and Stars and Stripes reporting list Fort Huachuca (Arizona), Fort Irwin (California), Travis Air Force Base (California), F.E. Warren Air Force Base (Wyoming), Naval Station Newport (Rhode Island) and Columbus Air Force Base (Mississippi).
• The units overheated rather than losing power. Fort Huachuca said all its freezers went into defrost mode overnight, and produce and reach-in coolers were hit too. The store stayed open but couldn’t sell cold items. Reuters’ reporting also describes at least one case where temperatures were raised overnight.
• Investigators are working with France. The Pentagon said a Cyber Command unit is coordinating with interagency and law enforcement partners. The Army Criminal Investigation Division’s Cyber Field Office said it is working with French law enforcement on the refrigeration outages in Europe.
• No one has been publicly blamed. Officials have not attributed the incidents to a nation-state or criminal group.

The French incident

On the night of October 11, attackers took control of refrigeration systems at more than 350 French supermarkets, according to Reuters. Temperatures were pushed high enough to spoil stock, and some units caught fire. The head of the Les Mousquetaires group, which owns Intermarché, told French media he expected losses in the tens of millions of euros. France’s national cybersecurity agency ANSSI and the Paris prosecutor’s cybercrime unit are investigating, and no group has claimed responsibility.

U.S. military commissaries

• When: Late August 2026
• Scale: At least 6 stores
• Effect: Freezers entered defrost mode or ran warm, spoiling food
• Status: Suspected cyberattack; cause unconfirmed

French supermarkets

• When: Night of Oct. 11, 2026
• Scale: 350+ stores
• Effect: Temperatures raised, spoiling food; some units caught fire
• Status: Cyberattack; no group has claimed it

What’s still unclear

Reports on the French attack say Danfoss refrigeration controllers were targeted, and the security firm Claroty has reported vulnerabilities in Danfoss and Copeland equipment. But it hasn’t been established that those flaws were used in France or in the U.S. incidents. Records for one commissary, Naval Air Facility El Centro, which is not among the six reported, list a Danfoss system, and Reuters couldn’t determine whether military stores generally use Danfoss equipment. The Defense Commissary Agency runs 235 stores worldwide, and investigators haven’t said whether other locations or systems were affected.

Why it matters

If confirmed, the incidents would show how exposed everyday operational technology can be. Commercial refrigeration controllers are often managed remotely so contractors can monitor and adjust temperatures. When those portals are reachable from the public internet, or run old firmware or default passwords, they become an obvious target. After the French attack, France’s CERT-FR warned operators against exposing management interfaces to the internet. General guidance for operators includes:

1. Isolate control systems from the public internet.
2. Require multi-factor authentication and encrypted VPNs for remote technician access.
3. Update legacy firmware and replace factory-default credentials.

The August failures were first flagged publicly on August 28 by a blog called Signal and Silence, according to Reuters. Federal investigators have not said how an intruder, if there was one, would have gotten in.

Source: Reuters (Raphael Satter, AJ Vicens and Phil Stewart), Oct. 29, 2026; Stars and Stripes, Aug. 28, 2026.