Fridge outages are next hacking frontier, and Pentagon is asking if U.S. military bases were targets

There’s no proof yet that the two are connected, or that the commissary failures were a hack at all. But the same kind of target experienced the same type of outage within about two months of each other, which is enough to raise the eyebrows of Christopher Whyte, an associate professor of homeland security and emergency preparedness at Virginia Commonwealth University. 

“You’d be silly not to be suspicious,” he told Fortune. 

For the stores, the damage can’t be undone: Two supermarkets, Intermarché and E.Leclerc, reported an estimated €270,000, about $300,000 in combined stock damages, according to local news outlet Sud Ouest.

“Refrigerators give an attacker a weirdly direct route…to financial loss that’s, with cyber, unusually irreversible,” Whyte said. “You can’t unspoil food or other products from these freezers. It’s just Euros and dollars down the drain.”

Napoleon Bonaparte, the French military general who met an infamous defeat in Russia after overextending his supplies, is credited as saying, “An army marches on its stomach.”

The aphorism, also attributed to Prussian King Frederick the Great, refers to the necessity of food and basic logistics for a military campaign’s success. It’s not surprising, then, that refrigeration may be the next frontier of widespread cybersecurity attacks.

Earlier this month, hackers targeted hundreds of French supermarkets, raising the temperature of their refrigeration and freezer systems overnight to more than 122 degrees Fahrenheit, spoiling food and causing fires. The affected grocery stores included 80 Carrefour locations, about two-dozen Monoprix stores, and 150 Intermarche stores. The Paris prosecutor’s office called the outages a “large-scale” attack. Similar outages were reported across Europe.

The Pentagon’s investigation—and a partnership with French authorities to probe the French supermarket outages—followed a series of refrigerator outages across several U.S. military commissaries in August. More than a half-dozen commissaries were impacted by the disruption, including in Fort Irwin, California; Holloman Air Force Base, New Mexico; Naval Station Newport, Rhode Island; Little Rock Air Force Base, Arkansas; F.E. Warren Air Force Base, Wyoming; Robins Air Force Base, Georgia; and Fort Huachuca, Arizona, the Military Times reported at the time. Commissaries typically offer subsidized goods to those living on military bases, costing about 25% less than civilian grocery stores.

The Substack Signal and Silence was first to report the possibility that outages were a result of a hack.

The Pentagon confirmed the Defense Criminal Investigative Service, the criminal investigative arm of the agency’s Office of Inspector General, is leading a joint investigation into the outages, but said in a statement to Fortune, “For security reasons, we do not comment on ongoing law enforcement investigations.”

Cyber incidents, particularly targeting corporations and government agencies, have been on the rise over the last two decades, including more than a dozen major attacks this September alone, according to the Center for Strategic and International Studies. Cybercrime is projected to cost the global economy $10.8 trillion this year, according to Cybersecurity Ventures, more than triple the $3 trillion it cost in 2015. Rapidly developing AI capabilities have made hacking more sophisticated, while the number of appliances attached to the internet have created more targets.

The cold, hard truths of the new era of cyberattacks

Cybersecurity experts believe it was only a matter of time before practical appliances like refrigerators became the target of cyberattacks. Nadiya Kostyuk, an assistant professor at the Carnegie Mellon Institute for Strategy and Technology, told Fortune it was an ongoing joke among her cohort to discuss when their home fridges would be hacked.

“I’m surprised that it took so long,” she said.

“A lot of these devices have a lot of really cool features, but the security is not the first priority for them,” Kostyuk added. “Hopefully future inventions will come with more security in mind when it comes to the design, and the existing ones also will be revisited to incorporate all the potential vectors of the cyberattacks.”

In the case of the outages in France, the vulnerabilities originated from access to the Danish-made Danfoss AK-SM, AK-SC series remote controllers for refrigeration systems, as well as Copeland xweb and Dixell xweb, according to an alert bulletin published by French authorities, and affected units were running outdated firmware hackers could exploit by accessing the devices through the internet.

More broadly, refrigeration systems present vulnerabilities because many of the devices are similar across commercial chains, and identifying an exposure in one means hackers can generalize that exposure to other systems, according to Whyte.

Beyond the accessibility of refrigeration systems, the consequences of outages yield practical consequences, which can make them appealing targets for hackers who want to make a statement or take a financial jab at a victim.

The U.S. military theater is vulnerable to emblematic attacks on supply stores as well. The USS Abraham Lincoln, which had a record deployment of 265 uninterrupted days at sea before it docked in San Diego earlier this month, became a symbol of weaknesses in U.S. military amenities. During its Iran war mission, the crew faced poor morale and mental health, including as a result of food and hygiene supply shortage.

Liberté, égalité, réfrigérite 

Gregory Winger, an assistant professor of international relations and cybersecurity at University of Maryland, Baltimore County, told Fortune that actors from Russia, China, Iran, and North Korea typically rely on cyberincidents that appear random but are actually connected. 

Allied countries have built partnerships for the express reason of identifying and sharing the techniques of hackers, particularly NATO’s Supreme Headquarters Allied Powers Europe (SHAPE) in Mons, Belgium, which is the body’s cybersecurity headquarters. Significant attacks can trigger NATO’s invocation of Article 5, a collective defense that defines a threat against one country as an effective threat against the body’s 32 members. Regardless if the outages in the U.S. military commissaries were from the same actor as the French supermarket outages, the U.S. was strategic to launch a joint investigation with France purely from an information-sharing standpoint, Winger argued.

“Right now,” he said, “every future military operation is going to have a cyber component to it.”