The malfunctions occurred in late August, with public reports citing disruptions at multiple military installations [6][7]. One official said military investigators were in touch with French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets in France earlier in October [3][8]. No public attribution or formal conclusion has been announced [1][9].
The Pentagon's treatment of the incidents as a suspected cyberattack marks a significant escalation in how the military views threats to operational technology -- the hardware and software that control physical systems like refrigeration units. The investigation is ongoing, and officials have not elaborated on the scope of the U.S. inquiry or on whether the incidents at the six commissaries were linked [1][9].
The Pentagon said a unit of Cyber Command, the military's cyber force, was working in close coordination with interagency and law enforcement partners, but it did not elaborate [1][9]. The U.S. Army Criminal Investigation Division said its Cyber Field Office was involved and was working with French law enforcement to better understand the refrigeration outages in Europe [1][10].
One official said military investigators were in contact with French counterparts about a similar cyberattack on commercial freezers in France earlier in October [3][8]. The French Embassy in Washington did not return a message seeking comment, according to Reuters [1].
The involvement of Cyber Command and the Army's Criminal Investigation Division underscores the seriousness with which the Pentagon is treating the incidents. Cyber Command is responsible for defending military networks and, when directed, conducting offensive cyber operations. The Army's Cyber Field Office specializes in investigating cyber-related crimes and intrusions [1][9].
Stars and Stripes reported the involvement of military investigators, and Britain's Daily Telegraph reported their contacts with the French, according to the article [1].
The deliberate heating of freezers -- rather than a simple power failure -- is a key indicator that has led investigators to suspect cyberattack. Such an operation would require gaining access to the control systems that regulate freezer temperatures, potentially through internet-connected controllers or building management systems [6][7].
The French cyberattack overrode temperature controls on commercial cooling units in more than 350 establishments, leading to spoiled merchandise being cleared from supermarket frozen food aisles [11][1].
The French incident provides a template for what investigators may be looking at in the U.S. cases.
The incidents highlight a broader vulnerability in critical infrastructure: operational technology systems that control physical processes are often designed without security in mind and are increasingly being connected to networks.
The investigation comes as the Pentagon has been working to improve its ability to protect critical infrastructure from cyberattacks. A 2016 Government Accountability Office assessment found that the Pentagon still had significant work to do before its protection of vital U.S. infrastructure could be deemed adequate [12].