Hackers may have found another way to disrupt US military installations, and this time, the target may be their freezers.
The Pentagon is investigating whether cyberattacks caused refrigeration failures at at least six US military commissaries, after freezers reportedly entered defrost mode and allowed food supplies to spoil.
The incidents, which occurred in August, predate those at French supermarkets, but raise similar uncomfortable concerns about how attackers manipulate the digital systems controlling equipment that supports everyday life — and, in this case, military operations.
The issue is that if attackers can compromise these systems, they may never need to compromise data and software — which are increasingly being secured — to wreak havoc on their target.
An August incident is getting renewed attention
The incident emerged in August, when several US military commissaries reported refrigeration failures that spoiled frozen food and left stores temporarily unable to sell certain products.
Stars and Stripes subsequently reported on Sept. 1 that the Army Criminal Investigation Division was investigating the outages, bringing an unusual equipment failure affecting military grocery stores into the scope of a military investigation.
Per Reuters, Fort Huachuca's Facebook page in Arizona disclosed on Aug. 26 that its freezer entered defrost mode overnight, heating its contents and spoiling the food.
Other affected installations included Fort Irwin in California, F.E. Warren Air Force Base in Wyoming, Naval Station Newport in Rhode Island, Columbus Air Force Base in Mississippi, and Travis Air Force Base in California.
However, the possibility that the failures were deliberate acts of cyber-sabotage only gained wider attention on Oct. 29, when Reuters reported, citing four officials familiar with the investigation, that the Pentagon was treating the incidents as suspected cyberattacks.
One official told the publication that military investigators had been in contact with their French counterparts over a similar attack on commercial refrigeration systems in France earlier in October.
Investigators have not linked the US and French incidents to any operator, and have yet to identify a responsible party.
The Pentagon also acknowledged that its Cyber Command unit was working closely with interagency and law enforcement partners, although it declined to provide further details.
Cyber threats increasingly target physical infrastructure
The US military refrigeration failures have not been conclusively linked to cyberattacks. However, the investigation highlights a broader security concern involving operational technology (OT), the systems used to monitor and control physical equipment.
Attackers have increasingly targeted connected infrastructure, including water utilities and fuel monitoring systems. Unlike traditional data breaches, attacks on operational technology can interfere directly with equipment and essential services.
The military freezer investigation raises questions about whether similar vulnerabilities could affect commercial refrigeration systems and other connected equipment. Investigators have not established whether the US incidents involved compromised controllers, unauthorized remote access, or another cause.
Water systems offer one example. In July 2026, the FBI and the Environmental Protection Agency (EPA) warned that malicious actors had targeted internet-facing water and wastewater utilities.
Fuel infrastructure has faced similar attention. In June, TechRepublic reported that hackers are targeting automatic tank gauge (ATG) systems. These systems monitor fuel levels and potential leaks in storage tanks.
Refrigeration systems appear to be a part of that broader shift in attack techniques.
These incidents differ in their targets and confirmed consequences. Still, they point to a common security concern: attackers are finding opportunities in the digital systems that monitor and control physical infrastructure.
Whether the objective is to disrupt water operations, interfere with fuel monitoring, or cause refrigeration equipment to malfunction, compromising these systems can create consequences that extend well beyond computers and stolen data.
Beyond the US military, what this means for everyone
The growing number of internet-connected devices makes these incidents relevant beyond the military. Smart TVs, security cameras, connected cars, home appliances, and industrial equipment are increasingly joining the internet-connected ecosystem, creating more opportunities for remote access and control. But that connectivity also introduces security risks.
For businesses, cybersecurity must extend beyond computers, servers, and business applications.
Organizations should prioritize security when purchasing connected equipment, choosing reputable manufacturers that provide regular firmware updates, security documentation, and long-term product support. They should also maintain an inventory of connected devices and install updates as they become available.
The French supermarket attacks illustrate the consequences of overlooking this responsibility. Danfoss disclosed that many affected refrigeration controllers had reached end of life and no longer received security updates, while some supported devices were running outdated firmware. Like computers, connected physical equipment can remain vulnerable when known security flaws go unpatched.
Individuals have lessons to take away, too. Smart cameras, televisions, and home assistants should not be installed and forgotten.
Owners should change default passwords, install available updates, turn off unnecessary remote-access features, and favor manufacturers that provide ongoing security support. Placing smart devices on a separate guest or IoT Wi-Fi network can also limit their access to personal computers and other sensitive devices.
Whether the US military freezer failures prove to be cyberattacks or equipment malfunctions remains unresolved. But the investigation underscores why organizations need to treat connected physical systems as part of their cybersecurity responsibilities.
When those systems fail, the consequences can extend beyond disrupted networks to spoiled supplies, interrupted services, and real-world operational losses.
Other news: Hackers are using fake ChatGPT and Claude downloads hosted on GitHub to spread Yoba malware, according to Check Point Research.