Pentagon Suspects Cyberattack After Freezers at Six US Military Bases Switched to Heating Mode Overnight

The Pentagon is investigating a suspected cyberattack after freezer failures spoiled food at at least six US military commissaries in late August. US Cyber Command and the Army Criminal Investigation Division are involved, while military investigators are coordinating with French authorities examining a separate refrigeration attack, Reuters reported on 29 October.

Investigators have not publicly identified a perpetrator or established the cause of the US failures. Published vulnerabilities in commercial refrigeration controllers provide technical context, but no public evidence links a particular manufacturer or vulnerability to the affected military stores.

Six Commissaries Report Refrigeration Failures

Fort Huachuca in Arizona described the problem in a Facebook post on 26 August, saying its freezer 'went into defrost mode where it heated up all the food. Trust us when we say it was "spoiled."' The other affected commissaries were at Fort Irwin in California, F.E. Warren Air Force Base in Wyoming, Travis Air Force Base in California, Naval Station Newport in Rhode Island and Columbus Air Force Base in Mississippi.

Some stores remained open for dry goods while refrigeration problems were addressed. Defrost cycles are a normal part of refrigeration, allowing ice to be removed from cooling coils. The reported failures involved temperatures rising enough to spoil food, but a freezer entering defrost mode does not, by itself, establish that a cyberattack occurred.

Danfoss Vulnerabilities Were Disclosed in 2025

Cybersecurity researchers at Claroty's Team82 research group have documented vulnerabilities in the AK-SM 800A series of refrigeration controllers made by Danish manufacturer Danfoss. The authentication-bypass flaw CVE-2025-41450 was disclosed in March 2025. Danfoss published an advisory on 1 August 2025 covering two further vulnerabilities, CVE-2025-41451 and CVE-2025-41452.

CVE-2025-41450 could allow an attacker to generate a web report exposing sensitive information, including internal IP addresses, usernames and store names. CVE-2025-41451 concerns command injection that could enable remote code execution after authentication, while CVE-2025-41452 involves a web-interface configuration flaw that could cause a denial-of-service condition. Danfoss issued firmware updates to address the vulnerabilities. Reuters could not establish whether the affected US commissaries used Danfoss controllers or another brand.

French Refrigeration Attack Draws Comparison

Reuters reported that a cyberattack disrupted refrigeration systems at more than 350 commercial establishments in France in October, spoiling food. Some refrigeration units reportedly overheated enough to catch fire. Danfoss said many controllers involved were obsolete or running outdated firmware, which could have made them easier to compromise. The precise attack path in France remained unconfirmed.

On 13 October, Team82 published a laboratory experiment in which an AI coding agent reproduced previously disclosed vulnerabilities in about 28 minutes, at an estimated usage cost of $6. The agent initially reproduced two flaws but failed to analyse the authentication bypass correctly. Researchers then supplied additional tools and guidance, enabling it to reproduce the bypass and combine it with command injection to demonstrate root access on a laboratory device. The experiment was not autonomous vulnerability discovery and does not show that AI was used in either incident.

Cyber Command and Army CID Join Inquiry

The Pentagon said a unit of US Cyber Command was 'working in close coordination with interagency and law enforcement partners', Reuters reported. The department did not provide further details about the investigation's progress or findings.

The US Army Criminal Investigation Division said its Cyber Field Office was involved and was working with French law enforcement to better understand 'the refrigeration outages in Europe'. The coordination establishes that investigators are examining the incidents, but neither statement confirms that the US failures resulted from malicious access.

Equipment and Cause Remain Unknown

Investigators have not publicly confirmed which controllers were installed at the affected commissaries, whether any equipment was running vulnerable firmware or whether unauthorised access occurred. The available reporting does not establish a shared technical cause between the US failures and the French attack.

Until investigators disclose those findings, the Danfoss vulnerabilities remain relevant technical context rather than proof of a breach. The central unanswered question is whether the US refrigeration failures resulted from malicious interference or another equipment or configuration problem.