Pentagon probes commissary freezer failures as possible hack after French supermarket attack
The Pentagon's criminal investigators are leading a joint probe into freezer failures at US military commissaries in August, treating the outages as a possible cyberattack, four officials told Reuters this week. The inquiry follows an overnight hack that pushed refrigeration controls at hundreds of French supermarkets above 122 degrees Fahrenheit, spoiling food and starting fires.
There is no proof yet that the two episodes are connected, or that the commissary failures were a hack at all. But the same kind of target suffered the same type of outage within about two months, which is enough to raise eyebrows. "You'd be silly not to be suspicious," Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, told Fortune. More than a half-dozen commissaries were affected, including at Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island and Little Rock Air Force Base in Arkansas, the Military Times reported at the time.
The French damage is already counted. Intermarché and E.Leclerc reported an estimated €270,000, about $300,000, in combined stock losses, according to local news outlet Sud Ouest. The affected stores included 80 Carrefour locations, about two dozen Monoprix stores and 150 Intermarché outlets, and the Paris prosecutor's office called the outages a "large-scale" attack. French authorities traced the vulnerabilities to internet-exposed Danfoss AK-SM and AK-SC remote controllers and Copeland and Dixell xweb units running outdated firmware.
"Refrigerators give an attacker a weirdly direct route to financial loss that's, with cyber, unusually irreversible," Whyte said. "You can't unspoil food or other products from these freezers." Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, told Fortune she was surprised it took so long: "A lot of these devices have a lot of really cool features, but the security is not the first priority for them."
The Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon's Office of Inspector General, is leading the joint investigation, the agency confirmed, adding that it does not comment on ongoing law enforcement investigations for security reasons. The Pentagon is also partnering with French authorities. Gregory Winger, an assistant professor of international relations and cybersecurity at the University of Maryland, Baltimore County, told Fortune that sharing information matters regardless of whether the same actor is behind both: "Every future military operation is going to have a cyber component to it."
