US defence investigators are treating a run of freezer failures at military base grocery stores as a possible cyberattack. Nothing has been confirmed, and the agency that runs the stores offers a more ordinary explanation.
What is known
- Failures have been reported at six or more commissaries, starting in late August.
- At Fort Huachuca, all the freezers reportedly switched to defrost during the night.
- The Defense Criminal Investigative Service is leading a joint inquiry with Army criminal investigators; the Pentagon’s inspector general and Cyber Command are also involved.
- US investigators are in contact with their French counterparts.
Two explanations
The pattern resembles the attacks on European supermarkets, where internet-reachable refrigeration controllers were ordered into defrost. On that reading, the commissary failures would be an earlier or parallel use of the same method.
The Defense Commissary Agency points instead to wear on heavily used equipment and long waits for manufacturer parts. No public evidence links the US failures to the European incidents, and no one has been named as responsible. Some outlets report that officials are considering an Iranian connection; the Pentagon has not confirmed that.
Why it is worth following either way
Telling an equipment fault from a deliberate command is hard when the controller keeps no trustworthy record of who changed a setting. That is the common condition for building and refrigeration systems: little logging, shared or default accounts, and remote access set up by a contractor years ago.
If the investigation finds a fault, the uncertainty itself is the finding. A site that cannot answer “was this us, the machine, or someone else?” within a few hours has a visibility problem.
What to check on your own site
- Do refrigeration, HVAC and building controllers log setpoint changes with a user and a source address?
- Are those logs kept somewhere the controller cannot overwrite?
- Who can reach these systems remotely, and through what?
- Is there an independent alarm when temperatures drift?