The Pentagon is investigating whether a cyberattack caused freezer failures that spoiled food at about six on-base grocery stores in August, Nextgov/FCW reported Thursday, citing a U.S. official. If confirmed, the case would show that ordinary refrigeration controls can be used to disrupt operations on U.S. military installations. Reuters first reported Thursday that investigators were treating the outages as a possible hack.
What Happened
The failures hit commissaries, the grocery stores on military bases that serve service members and their families, beginning in late August. At Fort Huachuca, Ariz., a freezer went into defrost mode and heated its contents, spoiling the food, Nextgov/FCW reported. Stars and Stripes reported Sept. 1 that affected stores temporarily could not sell meat, dairy, produce or frozen foods, and that the Defense Department had acknowledged only a "possible refrigeration disruption."
Four officials told Reuters the outages at at least six bases may have resulted from a hack, according to People's account of the Reuters report.
U.S. Cyber Command and several Defense Department law enforcement units are investigating, according to Nextgov/FCW. Reuters, as relayed by People, said the Defense Criminal Investigative Service leads a joint inquiry that includes the Army Criminal Investigation Division's Cyber Field Office. It is not known whether investigators have determined the cause, or how anyone reached the freezer controls. "For security reasons, we do not comment on ongoing law enforcement investigations," a Defense Department official told People.
U.S. officials are also in contact with French authorities. Earlier in October, hackers overrode temperature controls on commercial refrigeration at more than 350 establishments in France. The Primary Wire reported Oct. 12, citing Agence France-Presse, that supermarkets there had to throw out chilled food. No link between the U.S. and French incidents has been established.
Who Officials Suspect
Late Thursday, Nextgov/FCW reported that U.S. officials suspect Iran-linked hackers, citing two people familiar with the matter. The outlet cited no forensic evidence and said the assessment could change as investigators learn more. It noted the suspicion would fit recent suspected Iranian activity against water-treatment equipment. No government agency has publicly attributed the outages.
Why It Matters
Refrigeration in stores, warehouses and hospitals increasingly runs on networked controllers, small computers that set temperatures and defrost cycles and can often be reached remotely. The Food and Agriculture Information Sharing and Analysis Center, an industry threat-sharing group, has warned that attackers target internet-accessible industrial controls with weak defenses, Nextgov/FCW reported.
For executives and boards, the lesson does not depend on who is behind the outages. Knowing which units are online, who has remote access and whether firmware is current is basic exposure management.
What to Watch
- Whether the Defense Department, FBI or the Cybersecurity and Infrastructure Security Agency confirms a cause or attribution, or names the equipment involved.
- Any federal guidance for operators of networked refrigeration controls.
- Whether U.S. and French investigators find a link between the two sets of incidents.
