PORT CHARLOTTE, Fla. On Aug. 26, the commissary at Fort Huachuca, Arizona, told shoppers its power never went out. A freezer had gone into defrost mode and, in the store’s words, “heated up all the food.” Two months later, four officials have told Reuters that Pentagon investigators are treating that failure, and others like it at base grocery stores, as a suspected commissary freezer hack.
The people most affected are the ones who shop there: troops, spouses, military retirees and, since 2020, more than 4 million disabled veterans and caregivers who gained access. We pulled together what is on the record, from the Claroty security research published Aug. 9 to the store notices and Thursday’s reporting, so you can see the timeline in one place. One thing up front: no investigator has said publicly that a hack happened, and no Florida store has been named.
Inside the commissary freezer hack investigation
According to Reuters, as reported by Gizmodo and People on Oct. 29, the Defense Criminal Investigative Service, the criminal arm of the Pentagon inspector general, is leading a joint investigation. The Army Criminal Investigation Division’s Cyber Field Office is working with French law enforcement. The Defense Department said a Cyber Command unit is “working in close coordination with interagency and law enforcement partners.”
One Defense Department official put it more carefully: “We are aware of speculation regarding a potential cyber incident.” No suspects have been named. Reuters confirmed outages at no fewer than six bases. In at least one case, freezer temperatures were raised overnight, which is different from a unit simply quitting.
Fourteen stores, eleven states, one control system
The first public list came from an independent researcher. In late August, the newsletter Signal and Silence counted 14 reported outages at installations across 11 states, including Fort Irwin and Travis Air Force Base in California, F.E. Warren in Wyoming, Naval Station Newport in Rhode Island, Holloman and Cannon in New Mexico, Dyess in Texas and Robins Air Force Base in Georgia. Robins is the closest to Florida on that list.
The newsletter also found the thread that ties the stores together. A March 2026 Defense Commissary Agency contract for its Remote Monitoring Control System, or RMCS, covers about 182 locations, including all 14 on the list. The agency’s own refrigeration specification says, “Defrost shall be controlled through the RMCS.” The author was careful, too, writing, “I do not have evidence that the Defense Commissary Agency was hacked.” How much of that system can be controlled remotely is still unknown.
The Defense Commissary Agency runs 235 stores worldwide, according to Stars and Stripes. In early September the agency referred questions to the Pentagon, which would only confirm a “possible refrigeration disruption.”
The August warning about freezer controllers
Seventeen days before the first commissary notice, the industrial security firm Claroty published research on the controllers that run commercial refrigeration. Its Team82 report on Copeland XWEB Pro controllers, dated Aug. 9, lists 23 vulnerabilities, 21 of them rated high severity. Claroty wrote that an attacker could “physically manipulate refrigeration systems and silently spoil the contents.” Copeland fixed the flaws in firmware version 1.13. Claroty published separate findings on Danfoss AK-SM 800A controllers the same month.
What nobody has shown publicly is whether the affected commissaries use either brand, or whether their firmware was current. Gizmodo reported that at least one commissary uses a similar Danfoss system, but that store was not on the outage list.
France saw the same thing in October
On Oct. 12 and 13, attackers raised freezer temperatures at hundreds of French supermarkets. Reuters put the count at more than 350 businesses and facilities, and some units got hot enough to catch fire. Reuters reported that many of the French units were managed by Danish firm Danfoss and ran obsolete or outdated firmware. Officials told Reuters U.S. investigators are now comparing notes with their French counterparts.
Not every outage is an attack. When Ramstein Air Base in Germany lost whole sections of freezers in September, the agency told Stars and Stripes it was worn-out equipment and slow parts deliveries, and said those failures were unrelated to the August outages in the U.S.
Who shops at the commissary now
This is bigger than one aisle of ice cream. Since Jan. 1, 2020, commissary access has included Purple Heart recipients, former prisoners of war, veterans with any VA service-connected disability rating and primary family caregivers in the VA’s comprehensive caregiver program, according to Military OneSource. Veterans need a VA Veteran Health Identification Card that shows the qualifying status.
For a young enlisted family stretching a paycheck, or a retiree on a fixed income, a closed meat case means a more expensive trip off base. The stores stayed open for dry goods, but at least six told customers they could not sell meat, dairy, produce or frozen food for a time.
What commissary shoppers can do now
- Check your installation commissary’s Facebook page before a big shopping trip. That is where the August notices first appeared.
- If you bought chilled or frozen food around an outage and it looks or smells off, don’t eat it. Take it to customer service and ask about a return.
- Report anything strange, like a freezer case that feels warm, to store staff. A timestamped report helps investigators.
- If you are a disabled veteran or caregiver who has never used your access, get your VHIC updated through the VA first.
Cyber threats to everyday systems are not new for us to cover. We reported on the ShinyHunters arrest in the Netherlands and on the Nebraska lawsuit over Lorex security cameras, two stories about connected devices that people trust without a second thought. For more, see our National Security coverage.
Twenty-plus years in aerospace manufacturing taught me one rule: when a dozen machines fail the same week, look for the common part. Here the common part may be a remote control system at about 182 stores. I’m not calling it a hack, because investigators haven’t. But military families got two months of “possible refrigeration disruption,” and that’s not good enough. DeCA should tell its shoppers whether those controllers are patched, and Congress should ask before the next one heats up.
Have a tip or a correction on this story? Reach us through our Contact page.
Rocci J. Stucci is the founder and CEO of Stucci Media and host of The Rocci Stucci Show.
