NewsMacroPentagon Probes Possible Cyberattack After Freezer Failures at U.S. Military Commissaries Follow French Supermarket Hack

Pentagon Probes Possible Cyberattack After Freezer Failures at U.S. Military Commissaries Follow French Supermarket Hack

Author: Fortune Crypto·

Key Takeaways

  • •The Pentagon's Defense Criminal Investigative Service is leading a joint investigation into August freezer failures at U.S. military commissaries, including installations in California, New Mexico, Rhode Island, Arkansas, Wyoming, Georgia, and Arizona, with officials describing the incidents as a possible cyberattack.
  • •Hackers recently forced refrigeration systems at hundreds of French supermarkets, including 80 Carrefour, roughly two dozen Monoprix, and 150 Intermarché locations, above 122 degrees Fahrenheit overnight, spoiling food and starting fires in an attack the Paris prosecutor's office called large-scale.
  • •There is currently no evidence connecting the U.S. commissary outages to the French supermarket attacks or confirming that the commissary failures involved a hack at all.
  • •French authorities traced the supermarket attack to outdated firmware in remotely accessible Danfoss, Copeland, and Dixell refrigeration controllers, and experts note that similar equipment across chains lets hackers generalize a single identified exposure.
  • •Intermarché and E.Leclerc reported an estimated €270,000, or about $300,000, in combined spoiled stock losses, illustrating the unusually irreversible financial damage refrigeration attacks can inflict.
Pentagon Probes Possible Cyberattack After Freezer Failures at U.S. Military Commissaries Follow French Supermarket Hack

The Pentagon’s criminal investigators are leading a joint probe into freezer failures that struck U.S. military commissaries in August, and four officials told Reuters this week that the agency is treating the incidents as a possible cyberattack. The investigation comes just weeks after hackers seized control of the refrigeration systems at hundreds of French supermarkets overnight.

There is no evidence yet that the two events are connected, or that the commissary failures involved a hack at all. Still, the fact that the same type of target experienced the same kind of outage within roughly two months of each other is enough to raise eyebrows, said Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University.

“You’d be silly not to be suspicious,” he told Fortune.

For the affected stores, the damage cannot be undone. Two supermarket chains, Intermarché and E.Leclerc, reported an estimated €270,000—about $300,000—in combined stock losses, according to local news outlet Sud Ouest.

“Refrigerators give an attacker a weirdly direct route…to financial loss that’s, with cyber, unusually irreversible,” Whyte said. “You can’t unspoil food or other products from these freezers. It’s just Euros and dollars down the drain.”

An Army Marches on Its Stomach—and Its Freezers

Napoleon Bonaparte, the French military general whose infamous defeat in Russia followed an overextended supply line, is credited with saying, “An army marches on its stomach.” The aphorism, also attributed to Prussian King Frederick the Great, speaks to the centrality of food and basic logistics to any military campaign’s success. It is little surprise, then, that refrigeration may be emerging as the next frontier of widespread cyberattacks.

Earlier this month, hackers targeted hundreds of French supermarkets, pushing the temperature of their refrigeration and freezer systems overnight to more than 122 degrees Fahrenheit, spoiling food and starting fires. The affected grocery stores included 80 Carrefour locations, about two dozen Monoprix outlets, and 150 Intermarché stores. The Paris prosecutor’s office described the outages as a “large-scale” attack, and similar incidents were reported across Europe.

The Pentagon’s investigation—along with a partnership with French authorities to probe the French supermarket outages—followed a series of refrigerator failures across several U.S. military commissaries in August. More than a half-dozen commissaries were hit by the disruption, including at Fort Irwin, California; Holloman Air Force Base, New Mexico; Naval Station Newport, Rhode Island; Little Rock Air Force Base, Arkansas; F.E. Warren Air Force Base, Wyoming; Robins Air Force Base, Georgia; and Fort Huachuca, Arizona, Military Times reported at the time. Commissaries typically sell subsidized goods to personnel living on military bases at prices roughly 25% below those of civilian grocery stores.

The Substack Signal and Silence was the first to report that the outages might have been the result of a hack.

The Pentagon confirmed that the Defense Criminal Investigative Service, the criminal investigative arm of the agency’s Office of Inspector General, is leading a joint investigation into the outages, but said in a statement to Fortune, “For security reasons, we do not comment on ongoing law enforcement investigations.”

Cyber incidents, particularly those targeting corporations and government agencies, have been on the rise over the past two decades, including more than a dozen major attacks in September alone, according to the Center for Strategic and International Studies. Cybercrime is projected to cost the global economy $10.8 trillion this year, according to Cybersecurity Ventures—more than triple the $3 trillion it cost in 2015. Rapidly developing AI capabilities have made hacking more sophisticated, while the growing number of internet-connected appliances has created more targets.

The Cold, Hard Truths of a New Era of Cyberattacks

Cybersecurity experts believe it was only a matter of time before practical appliances like refrigerators became targets of cyberattacks. Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, told Fortune that discussing when their home fridges would eventually be hacked had become an ongoing joke among her cohort.

“I’m surprised that it took so long,” she said.

“A lot of these devices have a lot of really cool features, but the security is not the first priority for them,” Kostyuk added. “Hopefully future inventions will come with more security in mind when it comes to the design, and the existing ones also will be revisited to incorporate all the potential vectors of the cyberattacks.”

In the case of the French outages, the vulnerabilities originated from access to Danish-made Danfoss AK-SM and AK-SC series remote controllers for refrigeration systems, as well as Copeland xweb and Dixell xweb controllers, according to an alert bulletin published by French authorities. The affected units were running outdated firmware that hackers could exploit by accessing the devices over the internet.

More broadly, refrigeration systems present vulnerabilities because many devices are similar across commercial chains, and identifying an exposure in one means hackers can generalize it to other systems, according to Whyte. Beyond their accessibility, the practical consequences of such outages make refrigeration an appealing target for hackers looking to make a statement or land a financial blow against a victim.

The U.S. military is equally vulnerable to emblematic attacks on its supply stores. The USS Abraham Lincoln, which completed a record deployment of 265 uninterrupted days at sea before docking in San Diego earlier this month, became a symbol of weaknesses in U.S. military amenities. During its Iran war mission, the crew faced poor morale and mental health struggles, driven in part by shortages of food and hygiene supplies.

Liberté, Égalité, Réfrigérité

Gregory Winger, an assistant professor of international relations and cybersecurity at the University of Maryland, Baltimore County, told Fortune that actors from Russia, China, Iran, and North Korea typically rely on cyber incidents that appear random but are actually connected.

Allied countries have built partnerships for the express purpose of identifying and sharing hackers’ techniques—most notably NATO’s Supreme Headquarters Allied Powers Europe (SHAPE) in Mons, Belgium, which serves as the alliance’s cybersecurity headquarters. Significant attacks can trigger NATO’s invocation of Article 5, a collective defense provision that defines a threat against one member as an effective threat against all 32 members of the alliance.

Regardless of whether the U.S. military commissary outages stemmed from the same actor behind the French supermarket attacks, Winger argued that the United States was strategic in launching a joint investigation with France purely from an information-sharing standpoint.

“Right now,” he said, “every future military operation is going to have a cyber component to it.”

This story was originally featured on Fortune.com.