Illustration: Investigations into commissary refrigeration outages continue without findings
Defense Commissary Agency · Breach

Investigations into commissary refrigeration outages continue without findings

· 1 min read

U.S. military commissaries suffered near-simultaneous refrigeration outages in late August 2026; freezers went into defrost mode and thousands of dollars of food spoiled. The Army CID Cyber Field Office, AFOSI and the Defense Criminal Investigative Agency are investigating, with no findings announced as of September 30; the DoD acknowledges only a 'possible refrigeration disruption.' On that date, DeCA said outages at four stores in Germany and England stem from equipment failures and are unrelated to the U.S. case.

WhatsApp LinkedIn X
MediumBreachNo software to update
In this article
  1. What happened
  2. Why it matters
  3. What to do
  4. For the technical team
  5. Timeline
  6. Sources

What happened

U.S. military commissaries reported near-simultaneous refrigeration outages in late August 2026. Freezers went into defrost mode, food spoiled, and stores sold dry goods only. Three military criminal investigation agencies are investigating; no findings have been announced.

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Why it matters

At least six bases confirmed outages and unverified sources say up to a dozen stores, in a network of 235. Losses include spoiled food and limited sales, plus unconfirmed suspicion of interference with internet-linked refrigeration controls. Commissaries serve active-duty members, families and retirees at prices at least 25% below civilian stores.

What to do

Track the investigation results (Army CID, AFOSI, DCIA) and DoD statements. As a precaution, review access control, segmentation and independent temperature alarms on remotely managed refrigeration systems.

For the technical team

Affected
Defense Commissary Agency (DeCA) Sistema de refrigeração e de monitoramento/controle remoto das lojas commissary (fornecedor não divulgado) · Refrigeration systems at Defense Commissary Agency (DeCA) commissaries; controller vendor, model and versions not disclosed.
Exploitation
No attack confirmed. The DoD cites a 'possible refrigeration disruption' and says it would be inappropriate to speculate on the cause; officials did not answer whether unauthorized access is a concern. Active investigations: Army CID Cyber Field Office, AFOSI and the Defense Criminal Investigative Agency (lead), with no details on their nature. Research cited by security outlets notes security flaws in refrigeration systems that make them vulnerable to an outside attack.
Fix
No fix announced. Fort Irwin completed freezer repairs and restocked within 48 hours; DeCA moved products to alternate temperature-controlled locations and stores stayed open selling dry goods.
Vector
DeCA commissary refrigeration with online remote monitoring and control; controller vendor and model not disclosed. The page 'U.S Army W.T.F! Moments' reported that fridges linked to an online system were shut off over several nights; the DoD has not confirmed a cause.
More details
At least six stores confirmed: Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB and Travis AFB; Military Times also lists Holloman AFB, Little Rock AFB and Robins AFB, and NAS Lemoore is cited by the Signal and Silence newsletter. Fort Huachuca reported all freezers went into defrost mode and all frozen food spoiled. Unverified sources say up to a dozen stores; the page 'U.S Army W.T.F! Moments' cited at least 18. September outages at four European stores (Ramstein, Vogelweh, Grafenwoehr and Lakenheath) were attributed by DeCA to equipment failures and delays in specialized parts, unrelated to each other and to the U.S. case, with completion targeted for mid-October. In May, DeCA awarded contracts to modernize refrigeration across 16 European stores. DeCA runs 235 stores worldwide. The CID Cyber Field Office responds to computer intrusions, insider threats and other malicious cyber activities. Related coverage cited by the source mentions hackers raising fridge temperatures at hundreds of French supermarkets to spoil food.

Timeline

  1. Incident opened.

Sources 4 sources

See all 6 sources

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click