Pentagon Probes Freezer Cyberattacks at Six US Military Commissaries Linked to French Supermarket Hack

What Happened

The Pentagon is investigating a string of freezer malfunctions at six US military base commissaries in late August 2026 as a suspected cyberattack, according to four officials familiar with the matter. At Fort Huachuca in Arizona, the base's Facebook account posted on August 26 that a freezer had entered a defrost mode that heated all food to spoilage temperatures overnight. In at least one case, investigators found someone had deliberately cranked freezer temperatures up rather than the units simply failing mechanically, leaving food wilted and melted by morning. The US Army Criminal Investigation Division's Cyber Field Office is leading the investigation and is working with French law enforcement on what it described as the refrigeration outages in Europe. A unit of US Cyber Command is also coordinating with other interagency partners. The Pentagon stated it is working in close coordination with interagency and law enforcement partners but has not disclosed how far the investigation has progressed or whether officials have reached conclusions about attribution or motive.

Reuters reviewed Facebook posts and website updates from the affected bases and confirmed at least six commissaries across the United States experienced similar freezer anomalies. The incidents resembled a widespread cyberattack on commercial freezers in France earlier in October 2026 that struck more than 350 establishments nationwide, including supermarkets operated by Intermarché, Leclerc, and Coopérative U. French authorities reported that attack overrode temperature controls, forcing refrigeration units into continuous defrost cycles at 122 degrees Fahrenheit — far above normal defrost temperatures. Some units caught fire from excessive heat. Dominique Schelcher, president of Coopérative U, confirmed the French incident and called the situation extremely serious, with losses expected to climb into millions of euros as shops discard spoiled food.

What the Evidence Establishes

Multiple independent sources confirm the Pentagon treats the late August commissary freezer failures as a suspected cyberattack rather than routine equipment failure. The key forensic indicator is evidence that freezer temperatures were deliberately raised overnight at one or more locations, a pattern inconsistent with spontaneous mechanical failure. The US Army Criminal Investigation Division's Cyber Field Office has been formally engaged, signaling the matter is being handled as a potential criminal intrusion rather than a maintenance issue. US Cyber Command coordination indicates the incident has been elevated to a national-level cyber defense concern. French authorities have confirmed a coordinated attack on over 350 supermarket refrigeration systems in October 2026 that used identical tactics — forcing units into continuous defrost at 122 degrees — causing fires and tens of millions of euros in damage. Danish manufacturer Danfoss produced the controllers targeted in the French attack, and the company acknowledged in 2022 that hackers exploited outdated versions of its cold storage controllers in Russia and Israel. It remains unconfirmed whether the affected US commissaries used Danfoss controllers or another brand, as Danfoss did not respond to requests for comment.

The temporal proximity is notable: the US commissary incidents occurred in late August 2026, while the French supermarket attack was reported in early October 2026. US investigators are now in active communication with French counterparts, suggesting intelligence sharing about tactics, techniques, and procedures. A precedent exists from December 2025, when federal prosecutors in Los Angeles accused a Ukrainian woman of belonging to a hacker group that disabled refrigeration at a meatpacking facility in 2024, ruining over 2,000 pounds of meat. This establishes that refrigeration system targeting by threat actors is an established pattern, not a novel concept. The involvement of both military criminal investigators and Cyber Command indicates the Pentagon views this as potentially crossing the threshold from criminal activity to national security concern.

Where the Accounts Conflict

The primary conflict centers on attribution and timeline. The Breitbart report cites four unnamed officials stating the Pentagon is treating the incidents as a suspected cyberattack, while the Pentagon's public statement is limited to acknowledging coordination with interagency partners without confirming the cyberattack assessment. The source does not clarify whether all six affected commissaries showed evidence of deliberate temperature manipulation, or only the single case explicitly described. The French attack timeline creates ambiguity: US incidents occurred in late August, French incidents in early October. If the same actor is responsible, the US incidents would have preceded the French campaign, reversing the assumed direction of intelligence flow. Alternatively, the French attack may have begun earlier than publicly reported, or the two campaigns may be unrelated but technically similar. The source does not provide details on whether forensic analysis of the US commissary controllers has been completed or whether indicators of compromise match those from the French incident.

Danfoss's role remains unclear. The French attack reportedly targeted Danfoss controllers, some of which were obsolete or running outdated firmware. The source explicitly states it is not clear whether Danfoss controllers or another brand were used at affected US bases. Danfoss's 2022 acknowledgment of vulnerabilities in outdated controller versions creates a plausible attack vector, but without confirmation of equipment commonality, the link remains inferential. The December 2025 Los Angeles prosecution involved a Ukrainian national accused of participating in a 2024 meatpacking facility attack, but the source provides no evidence connecting that case to either the US commissary or French supermarket incidents. The narrative gap between the source's framing — which emphasizes the French parallel — and the actual evidence base, which shows temporal separation and unconfirmed technical commonality, warrants caution in assuming a single campaign.

Context and Stakes

Commercial and military refrigeration systems increasingly rely on internet-connected industrial control systems (ICS) that manage temperature cycles, defrost schedules, and inventory monitoring. Danfoss, a major Danish manufacturer of such controllers, acknowledged in 2022 that threat actors exploited outdated firmware versions in Russia and Israel, demonstrating a known vulnerability class. The French attack's scale — 350+ establishments, fires from overheating, tens of millions in euros — illustrates the destructive potential when such vulnerabilities are weaponized at scale. For military commissaries, the stakes extend beyond food spoilage costs. Commissaries serve as critical quality-of-life infrastructure for service members and families, and their supply chains are integrated with broader Defense Logistics Agency operations. A successful intrusion into commissary ICS networks could provide a foothold for lateral movement into base operational networks, particularly if segmentation between retail and command systems is insufficient.

The involvement of US Cyber Command alongside the Army Criminal Investigation Division suggests the Pentagon is assessing whether this constitutes a Title 10 or Title 50 operation — in other words, whether the intrusion warrants a military cyber response option. Historically, attacks on critical infrastructure that cause physical damage (fires, equipment destruction) cross a threshold that triggers more robust policy responses. The 2024 meatpacking facility attack prosecuted in Los Angeles resulted in criminal charges but did not elicit a national-level cyber command response, suggesting the commissary incidents may involve additional factors such as evidence of state sponsorship, persistence mechanisms, or intelligence collection activity. The French government's characterization of their attack as extremely serious and mobilization of national investigative resources indicates NATO allies are treating refrigeration ICS targeting as a significant threat vector. If the same vulnerability class affects both US military and French civilian systems, it represents a shared supply chain risk across allied critical infrastructure.

What to Watch Next

The immediate indicator will be whether the Pentagon issues a formal attribution statement or refers the matter to the Department of Justice for indictment, as occurred with the 2024 meatpacking case. A DOJ indictment naming a specific threat actor or state sponsor would confirm the criminal investigation has developed sufficient evidence for prosecution. Absent public attribution, watch for classified briefings to the House and Senate Armed Services Committees' cyber subcommittees, which typically receive notification when Cyber Command engages on domestic base incidents. The Danfoss equipment question should resolve within weeks: investigators will have inventoried controller models and firmware versions at all six affected commissaries. If Danfoss controllers with known vulnerable firmware are confirmed, expect a Defense Logistics Agency directive mandating firmware updates or replacement across all commissary refrigeration systems, potentially extending to other military retail and dining facilities.

French investigative outcomes will provide parallel intelligence. If French authorities identify the threat actor — whether criminal ransomware group, state-sponsored APT, or hacktivist collective — US investigators will assess whether tactics, infrastructure, or malware overlap with the commissary incidents. The European Union's NIS2 Directive, which took effect in October 2024, mandates incident reporting for critical infrastructure operators including food retail; French supermarket disclosures may reveal technical details not yet public. Domestically, watch for CISA advisories regarding industrial control system vulnerabilities in commercial refrigeration, which would signal the US government assesses the threat as broadly applicable beyond military bases. Finally, monitor US Cyber Command's posture statements: if the command elevates refrigeration ICS to a named threat category in its 2027 posture testimony, it indicates the commissary incidents triggered a strategic reassessment of cold-chain infrastructure as a target set.

Bottom Line

The Pentagon is investigating deliberate freezer temperature manipulation at six US military commissaries in late August 2026 as a suspected cyberattack, with forensic evidence showing temperatures were intentionally raised rather than equipment failing spontaneously. The US Army Criminal Investigation Division's Cyber Field Office and US Cyber Command are engaged, coordinating with French authorities who experienced a larger-scale attack on 350+ supermarkets in October 2026 using identical tactics — forcing refrigeration units into continuous 122-degree defrost cycles causing fires and tens of millions in damages. Danish manufacturer Danfoss controllers were targeted in France; the company previously acknowledged 2022 exploitation of outdated firmware in Russia and Israel. Whether US commissaries used the same equipment remains unconfirmed. The temporal sequence (US incidents in August, French in October) complicates attribution assumptions. A 2024 precedent exists: a Ukrainian national was charged in Los Angeles for a meatpacking facility refrigeration attack. The engagement of Cyber Command suggests the Pentagon assesses this as potentially exceeding criminal thresholds. Key unknowns: attribution, equipment commonality, whether intrusion extended beyond commissary ICS into base networks, and whether this represents a new persistent threat to cold-chain infrastructure across NATO allies. The investigation's classification level and absence of public attribution indicate evidence remains insufficient for definitive conclusions.