The Pentagon is investigating a possible cyberattack after refrigeration systems failed at more than half a dozen US military commissaries in August, weeks before hackers disrupted freezers at hundreds of French supermarkets.
There is no evidence yet that the incidents are connected, or that the commissary failures were caused by hacking. However, the similarities have prompted a joint probe led by the Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon’s inspector general.
The affected US facilities included commissaries at Fort Irwin in California, Holloman Air Force Base in New Mexico, Naval Station Newport in Rhode Island, Little Rock Air Force Base in Arkansas, F.E. Warren Air Force Base in Wyoming, Robins Air Force Base in Georgia and Fort Huachuca in Arizona.
Commissaries provide subsidised goods to people living on military bases, with prices typically about 25 per cent lower than those at civilian supermarkets.
The Pentagon confirmed that the investigation was under way but declined to comment further, saying: “For security reasons, we do not comment on ongoing law enforcement investigations.”
The inquiry is also being conducted in partnership with French authorities examining a separate incident in which hackers took control of refrigeration systems at hundreds of supermarkets overnight.
French supermarket refrigeration systems targeted
About 80 Carrefour stores, roughly two dozen Monoprix outlets and 150 Intermarché supermarkets were affected in France. Refrigeration and freezer temperatures were raised to more than 122 degrees Fahrenheit, spoiling food and causing fires.
France’s Paris prosecutor’s office described the disruption as a large-scale attack. Similar outages were reported elsewhere in Europe.
Two of the affected supermarket chains, Intermarché and E.Leclerc, estimated their combined stock losses at about €270,000.
Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University, said the timing and nature of the incidents warranted suspicion.
“You’d be silly not to be suspicious,” he said.
Whyte said refrigeration systems offered attackers a direct means of causing financial damage because spoiled food could not be recovered. He added: “You can’t unspoil food or other products from these freezers. It’s just Euros and dollars down the drain.”
French authorities said the vulnerabilities involved Danish-made Danfoss AK-SM and AK-SC remote controllers, as well as Copeland xweb and Dixell xweb systems. The affected equipment was running outdated firmware and could be reached through the internet.
Experts have warned that refrigeration systems may be particularly exposed because similar equipment is used across commercial chains. A weakness identified in one system could therefore be applied to others.
Military commissaries become part of wider cyber inquiry
The possibility that the US outages resulted from a cyberattack was first reported by the publication Signal and Silence. The Pentagon’s criminal investigators are now examining the failures alongside the French supermarket incidents.
Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, said it was unsurprising that practical appliances had become targets.
“I’m surprised that it took so long,” she said, adding that security was often not the first priority when devices were designed.
Gregory Winger, an assistant professor of international relations and cybersecurity at the University of Maryland, Baltimore County, said Russia, China, Iran and North Korea typically carried out cyber incidents that could appear random while being connected.
He said the investigation with France was strategically useful even if the same attacker was not responsible, because allied countries could share information about techniques used in attacks.
“Right now,” he said, “every future military operation is going to have a cyber component to it.”
