The U.S. Defense Department is investigating whether refrigeration failures at military stores in August were caused by a cyberattack. The inquiry follows an incident in France in which supermarket cooling systems were remotely manipulated, spoiling food and sparking fires. The equipment and failure patterns appear similar, but there is no evidence linking the cases, and officials have not confirmed that the U.S. failures involved hacking.
The consequences can extend beyond equipment downtime. When refrigeration fails, food losses are often irreversible. Military stores also supply everyday goods to service members and their families, so prolonged disruption could affect access to basic items on base.
Refrigeration failures reported at seven U.S. bases
The Defense Department's Criminal Investigative Service, part of the Office of Inspector General, is leading a joint investigation. The Pentagon has declined to comment on an active law-enforcement inquiry, citing security concerns.
In August, refrigeration problems affected stores at at least seven military sites: Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island, Little Rock Air Force Base in Arkansas, F.E. Warren Air Force Base in Wyoming, Robins Air Force Base in Georgia and Fort Huachuca in Arizona.
Military stores typically sell subsidized goods to personnel and their families, with prices generally about 25% below those at civilian supermarkets. A prolonged outage can mean repair costs, spoiled inventory and disruption to supplies on base. Public information has not specified the losses from the U.S. failures or whether investigators found evidence of unauthorized access to the equipment.
Christopher White, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, said similar equipment failures at French supermarkets and U.S. military stores within roughly two months warrant scrutiny. But similarity alone does not establish a common attacker—or even prove that the U.S. incidents were cyberattacks.
French supermarkets reported €270,000 in losses
In October, refrigeration and freezer systems at hundreds of French supermarkets were manipulated overnight, with temperatures pushed above 122°F. Food spoiled, and fires were reported at some locations. The affected retailers included 80 Carrefour stores, about 24 Monoprix stores and 150 Intermarché stores. The Paris prosecutor's office described the incident as a “large-scale” attack, while similar failures were reported elsewhere in Europe.
Intermarché and E.Leclerc reported combined inventory losses estimated at €270,000, or about $300,000. White noted that spoiled food represents a direct, difficult-to-reverse cost, unlike many indirect losses associated with cyber incidents: repairing the equipment cannot restore food damaged by uncontrolled temperatures.
A security notice from French authorities said the incidents involved remote controllers for refrigeration systems, including Danfoss AK-SM and AK-SC series equipment and Copeland's xweb and Dixell xweb devices. The affected equipment was running outdated firmware, and attackers may have accessed it over the internet by exploiting vulnerabilities. France and the United States are also cooperating on the supermarket investigation. Sharing information on techniques and equipment can support an inquiry, but does not establish that the French and U.S. incidents are connected.
Internet-connected controllers can expose systems
Nadia Kostiuk, an assistant professor at Carnegie Mellon University's Institute for Strategy and Technology, said connected devices are gaining more functions, but security design does not always keep pace. Refrigeration controllers can become an entry point if firmware is not updated promptly or access protections are inadequate. She said manufacturers should account for security during product design, while operators should reassess potential attack paths in equipment already in use.
White added that commercial refrigeration systems often use similar equipment across multiple locations in a chain. If attackers find an exposed point in one type of system, they may be able to apply the same technique elsewhere. Because failures can spoil goods and disrupt supplies, the systems may appeal to actors seeking tangible effects.
Gregory Winger, an assistant professor of international relations and cybersecurity at the University of Maryland, Baltimore County, said state-linked actors from countries including Russia, China, Iran and North Korea sometimes conduct cyber operations that appear unrelated but may be connected. Sharing indicators and technical details among allies is important to identifying such activity, he said. Even if the U.S. military-store failures and French supermarket incidents ultimately prove to have different perpetrators, the joint U.S.-French investigation can still facilitate information sharing.
Supply-chain resilience is part of the cyber risk
The Center for Strategic and International Studies recorded more than 10 major cyber incidents in September alone. Cybersecurity Ventures estimates that cybercrime could cost the global economy $10.8 trillion this year, more than three times the $3 trillion estimate for 2015. The rapid development of artificial intelligence and the growing number of household and industrial devices connected to the internet are expanding both attack capabilities and potential targets.
Military logistics also depend on steady supplies of food, hygiene products and other essentials. The USS Abraham Lincoln returned to San Diego this month after a 265-day deployment. During its mission related to the Iran war, crew members faced shortages of food and hygiene items, among other challenges, affecting morale and mental health. Those experiences underscore the importance of supply continuity, but no information links the carrier to the refrigeration investigation.
The Pentagon has not released findings or confirmed the cause of the failures at U.S. bases. Investigators still need to determine whether the incidents involved network intrusions, whether the equipment had vulnerabilities that could be exploited remotely, and whether the U.S. and French cases share a technical or operational connection.