Suspected cyberattacks on internet‑connected refrigeration controls have spoiled food at US military commissaries and wrecked stock at hundreds of French supermarkets, exposing how supermarket freezers and warehouse chillers can be quietly sabotaged from afar.
The Pentagon is investigating refrigeration failures at at least six US commissaries after one installation reported that its equipment entered defrost mode and heated food until it spoiled. US investigators are also communicating with French authorities following a confirmed attack on supermarket refrigeration systems in France.
Pentagon Investigation Follows August Commissary Failures
The failures occurred in late August 2026 and affected at least six commissaries, according to four officials familiar with the investigation cited by Reuters.
A separate report by Task & Purpose said the Defense Criminal Investigative Service was leading a joint investigation involving the Defense Commissary Agency, Army Criminal Investigation Division and other agencies.
At Fort Huachuca in Arizona, the installation's Facebook account said a freezer had 'went into defrost mode where it heated up all the food'. The account added that the food was spoiled.
The Pentagon has not confirmed that hackers caused the failures. Cyber Command and Army investigators are examining the incidents, while the Army's Cyber Field Office is working with French law enforcement to understand related refrigeration outages in Europe.
The available evidence also does not establish whether the US commissaries used the same equipment involved in the French incident. No suspect or group has been publicly identified.
French Supermarkets Hit By Overnight Cyberattack
The US investigation follows a confirmed cyberattack that disrupted refrigeration systems at hundreds of French supermarkets overnight on 11–12 October 2026.
Attackers reportedly manipulated refrigeration controls, activating defrost cycles and raising temperatures as high as 50°C. Retailers discarded fresh and frozen food, while some equipment reportedly overheated or caught fire.
The attack affected supermarket groups including Intermarché, Carrefour, Monoprix and Coopérative U. French authorities opened a criminal investigation, while France's national cybersecurity agency, ANSSI, issued technical guidance through CERT-FR.
The CERT-FR bulletin identified affected systems from Danfoss, Copeland and Dixell. It advised operators to remove direct public‑internet exposure and restore remote access through protected networks. The bulletin also warned that attacks could still be continuing.
The French incident does not prove that the US commissary failures had the same cause. It does show how changing a digital control setting can create a physical disruption and cause food to be destroyed.
Researchers Found Weaknesses in Refrigeration Controllers
In August, Claroty's Team82 published research into Danfoss AK‑SM 800A refrigeration controllers. The researchers identified an authentication‑bypass mechanism, a command‑injection flaw and a configuration weakness affecting systems with internet‑accessible management interfaces.
Danfoss released firmware addressing the reported vulnerabilities. The research concerned the AK‑SM 800A platform, however, and does not establish that those specific flaws were used in France or at US military commissaries.
Danfoss later said many systems involved in the French incident were older, unsupported controllers, while some supported equipment was running outdated firmware. That distinction is important because vulnerability research and evidence of exploitation are separate matters.
Claroty also reported 23 vulnerabilities in Copeland XWEB Pro controllers, including 21 it classified as high severity. Its researchers demonstrated that a compromised supervisory controller could be used to manipulate refrigeration equipment in a controlled test environment. Copeland subsequently released a firmware update.
UK Exposure Adds a British Dimension
Analysis by UK Cyber Defence, reported by The Grocer, identified more than 800 internet‑accessible refrigeration and building‑control interfaces in the UK. The systems reportedly included equipment from Danfoss, Carel, Copeland and other manufacturers.
The finding does not show that 800 British supermarkets were using vulnerable refrigerators, nor does it indicate that any UK retailer had been compromised. It establishes potential exposure, rather than confirmed exploitation.
The UK National Cyber Security Centre has warned of increased targeting of operational‑technology systems across multiple sectors, including in Britain. Refrigeration is one example of technology that can produce physical consequences when digitally manipulated.
Comment
by u/seremot from discussion
in cybersecurity
A Reddit post from an IPinfo employee separately reported finding 2,528 publicly visible Danfoss StoreView interfaces across 73 countries and territories, including 1,331 in France and 101 in the US.
Those figures are self‑reported scan results and should not be presented as independently audited evidence or proof of the attack route. That same post has since been removed by a subreddit moderator.
The Pentagon investigation remains unresolved. Until officials identify the equipment involved and establish how the failures occurred, the relationship between the US incidents, the French attack and the disclosed controller vulnerabilities remains possible rather than proven.
