Military Commissary Freezers Failed at 14+ Bases. Was It a Hack?

Freezers at U.S. military commissaries started dumping their contents into active defrost mode on August 26, and the Pentagon still won't say why. The Department of Defense has confirmed only a "possible refrigeration disruption" at Defense Commissary Agency stores, but an independent security researcher has laid out a specific, testable theory: someone remotely triggered the defrost cycle on internet-connected refrigeration controllers, using a class of vulnerability that a cybersecurity firm published three weeks earlier.

At least seven bases are confirmed affected. Unofficial tallies from military family social media pages put the real number closer to 18 commissaries. Fort Huachuca in Arizona reported that every freezer in its store entered defrost mode simultaneously, with the power staying on the whole time, which is the detail that makes this look less like a string of coincidental hardware failures and more like a coordinated event.

RelatedPaperCut Rushes Emergency Patches After Confirmed Attacks

• DoD confirmed a refrigeration disruption at DeCA commissaries starting August 26, without naming a cause.
• At least 7 bases are officially confirmed hit; social media reports put the real count near 18.
• Fort Huachuca's entire freezer bank entered defrost mode at once while still powered, a pattern consistent with a remote command rather than a mechanical fault.
• Claroty published serious flaws in the exact refrigeration controllers involved, Danfoss AK-SM 800A and Copeland XWEB Pro, on August 9, three weeks before the outages began.

What actually happened at the commissaries?

Refrigeration units at Defense Commissary Agency stores started failing on August 26. Naval Station Newport posted restrictions first, Fort Irwin followed with updates through Thursday and Friday, and by the weekend the Pentagon issued a written statement acknowledging a "possible refrigeration disruption at some Defense Commissary Agency commissaries" and said DeCA had "taken appropriate precautions to transfer products to alternate temperature-controlled locations to mitigate any product loss." A defense official told Military Times it would be "inappropriate to speculate as to the cause." That is a notably careful sentence for equipment failure. Fort Huachuca's own account says the store's entire bank of freezers dropped into active defrost mode at the same time, with power never cutting out, which rules out a simple grid or breaker problem at that location.

Why does a hacking theory even hold up?

Because the mechanism exists and was published in public three weeks before the first outage. On August 9, the industrial-security firm Claroty disclosed 23 vulnerabilities in Copeland's XWEB Pro refrigeration platform, 21 of them rated high severity, alongside three flaws in Danfoss's AK-SM 800A controller, including one built around a hidden "code-of-the-day" authentication mechanism that a remote attacker could abuse for code execution. Both platforms are commercial-grade units deployed across supermarkets, cold storage warehouses, and yes, commissaries, and both are managed through a remote monitoring system, exactly the kind of internet-facing control plane the Fort Huachuca pattern points to. DeCA's own engineering documentation states that defrost cycles on its systems are controlled through that remote layer. None of that proves an intrusion happened. It does mean the tool for causing exactly this symptom, at exactly this scale, was sitting in public writeups by the time the freezers failed.

What else happened in the same three weeks?

Two more events sit inside the same window, and neither is speculation. On August 25, the NSA, CISA, FBI, DOE, and EPA jointly warned that a threat actor was running active reconnaissance against internet-exposed Siemens S7 PLCs using AI-generated exploit tooling, targeting critical manufacturing, energy, water, chemical, and food and agriculture sectors. Then on August 26, the same day the commissary outages began, the Justice Department and FBI announced they had seized two hacking platforms, QScan and QTRouter, tied to a Chinese contractor group known as QTFY. Court filings describe QScan as an IoT-scanning and infection layer feeding into QTRouter's proxy network, built to mask intrusions against U.S. critical infrastructure, and name confirmed victims including NASA, the Federal Reserve, and the Department of Energy. None of these three threads has been officially tied to the others. But an ICS vulnerability disclosure, a live nation-state PLC reconnaissance campaign, and a takedown of an IoT-scanning platform used against U.S. infrastructure, all inside 17 days, followed immediately by a multi-base refrigeration failure that DoD won't explain, is the kind of overlap a security analyst is professionally obligated to flag.

RelatedLedger Patched a Clear-Signing Flaw, Then Stayed Quiet

Who is affected if this is confirmed as an attack?

Directly, it's DeCA shoppers, roughly 14 to 18 base communities who lost frozen stock and, in some cases, went without a functioning commissary for days. Indirectly, it's every operator of a Danfoss AK-SM 800A or Copeland XWEB Pro anywhere, which includes ordinary grocery chains and cold-storage logistics firms far outside the military. If a remote defrost command is genuinely repeatable against an internet-reachable unit, patching to firmware R4.3.1 or 1.13 stops being optional IT hygiene and becomes the difference between a normal week and a walk-in freezer full of ruined stock.

1. Aug 9Claroty discloses 26 combined vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers. Fixes issued same disclosure.
2. Aug 19NSA and partner agencies begin circulating early warnings of ICS reconnaissance activity.
3. Aug 25CISA advisory AA26-231A: active AI-tooled reconnaissance against Siemens S7 PLCs in critical sectors, including Food and Agriculture.
4. Aug 26DOJ and FBI seize the QScan and QTRouter platforms built by China-linked group QTFY. Same day the commissary outages begin.
5. Aug 26–27Refrigeration failures reported at Fort Huachuca, F.E. Warren, Fort Irwin, Naval Station Newport, and other bases.
6. Aug 28–29DoD confirms a "possible refrigeration disruption," declines to name a cause.

Our take

Correlation across three independent security stories in the same 17 days is a legitimate reason to ask the question. It is not evidence of an answer, and readers should sit with that discomfort rather than resolve it prematurely. Mechanical refrigeration fleets do fail in clusters, especially aging commercial units running the same firmware bug regardless of any attacker. What tips this toward warranting real scrutiny is the Fort Huachuca detail: a full bank of freezers entering defrost simultaneously while powered is specific behavior that matches a remote command far better than it matches unrelated hardware wearing out. DoD's refusal to name a cause reads less like stonewalling and more like an active investigation that hasn't reached a conclusion, which is the responsible posture if there's any chance this touches an ongoing intrusion case. The honest version of this story is that DoD, DeCA, or Claroty could resolve it with one sentence confirming or ruling out unauthorized access, and as of publication none of them has said that sentence.

Original analysis by GenZTech, synthesizing DoD statements, Claroty's disclosed research, and federal cybersecurity advisories from the same three-week window.