Originally published: Aug. 28, 2026 astatine 1:18 p.m. PT.
Last Updated: Aug. 29, 7:27 PT
Since publication, Stars and Stripes, Military Times/Navy Times, and aggregate others person independently reported connected the multi-base refrigeration failures, pinch the Pentagon now acknowledging a “possible refrigeration disruption” astatine galore DeCA commissaries.
Near-simultaneous refrigeration failures aliases important issues impacting astatine slightest six subject installations person now been confirmed done charismatic sources during the past fewer days, pinch further independent confirmation of aggregate different incidents.
Self-aware capable to cognize this sounds insane, but I request you to instrumentality pinch me.
Not 1 freezer, not 1 market store, not conscionable ANY market store, either.
The refrigeration systems astatine subject commissaries (tax-free market stores for subject unit and their families located connected bases crossed the country) look to beryllium nether immoderate type of siege; either their ain aging fleet of instrumentality is deciding to seppuku successful cleanable harmony, aliases by thing (or someone) much nefarious.
Where to moreover begin?
Flipping done my normal rotation of societal media, I started seeing scattered posts lamenting the commissary abruptly losing their full refrigerated & stiff sections.
All acold nutrient spoiled, aliases removed from shelves.
Unfortunate and wasteful, I thought, but inconsequential to maine personally. I don’t shop there, I person nary liking successful the readiness of my stiff favs, positive the commissary is not precisely known for smoothly functioning operations, thus, moving on.
But past I saw different post, and another… pinch a chorus of comments
huh, really odd, the aforesaid point is happening here.
What are the chances!
The shape caught my attention, and what followed was a heavy dive into subject social-media chatter, commercialized refrigeration, defense procurement contracts, and web information refreshers successful an effort to resurrect the rudimentary cybersecurity knowledge my degrees required.
‘Twas ne'er my strongest subject. When would I ever request to usage this, I distinctly retrieve thinking. (Freezers didn’t person networks, successful the olden days)
At the clip of first publication, I identified 14 commissary refrigeration/freezer outage reports attributed to the pursuing subject installations crossed 11 states connected August 26–27. Subsequent additions denoted by asterisk, Reports later wished to beryllium unsupported/unrelated stay struck done for transparency.
Fort Huachuca (Confirmed)
F.E. Warren AFB (Confirmed)
Fort Irwin (Confirmed)
Columbus AFB (Confirmed)
Naval Station Newport (Confirmed Aug. 26; Restored Aug. 29)
*Travis AFB (Confirmed)
NAS Lemoore (Independently Confirmed; Restored Aug. 28 per Commissary employee)
*Port Hueneme (Independently Confirmed)
Little Rock AFB
Dyess AFB (Independently Confirmed; Restored Aug. 29 per Commissary employee)
Holloman AFB
Robins AFB
McConnell AFB
Cannon AFB
Fort Meade (Removed; operating usually per section arsenic of Aug. 28)
Camp Lejeune (Removed: charismatic outage announcement initially identified arsenic existent was really from 2025)
To beryllium very clear: I do not person grounds that the Defense Commissary Agency was hacked.
What does beryllium is grounds that thing overseas is happening, positive a full lotta explanations for really a cyber incident of this magnitude is technologically possible, and that location whitethorn beryllium much larger implications than a dearth of acold veggies.
Unfamiliar to maine prior, and I opportunity that intending nary discourtesy to you (lovely, I'm sure) Fort Huachucans; the Cochise County, Arizona guidelines has captured my attraction today.
On August 27th, the charismatic U.S. Army Fort Huachuca Facebook relationship announced that an overnight instrumentality nonaccomplishment caused ALL of the commissary’s freezers to participate defrost mode, spoiling everything inside.
This wasn’t a lawsuit of simply a powerfulness flickering and crystal pick melting, because personification commented just that. Fort Huachuca responded from its verified account:
“the powerfulness didn’t spell out”
Another questioned whether each of the nutrient was really “spoiled” if the freezers had simply stopped working.
The installation clarified that, no, the freezers hadn’t conscionable unopen off. They had entered defrost mode, which heated the food.
That is simply a very different problem and I’m afloat invested astatine this point. Buried successful the mostly useless comments, I unearthed what felt for illustration a gem:
“I was told that it was a web issue.”
This commenter claimed that Huachuca’s cold-storage instrumentality had been replaced comparatively recently, and that refrigeration and HVAC were remotely controlled done DeCA.
That is simply a random Facebook comment, from an unverified individual. It is not grounds that this was a web problem. But naturally, I perfectly had to cognize whether the 2nd portion was moreover possible.
Unfortunately for my productivity, it is.
I learned that commissaries (of which location are ~235 worldwide) aren’t really independently operated by immoderate subject installation aliases guidelines they hap to beryllium on.
They’re tally by the Defense Commissary Agency (DeCA), an agency seated wrong the Department of Defense.
DeCA, arsenic expected, has a full refrigeration-control infrastructure.
In March 2026, DeCA issued procurement documents seeking support for “Facilities Maintenance, Call Center Support, and Remote Monitoring Control System (RMCS) Management.”
It covers astir 182 DeCA locations, encompassing each 14 connected my original list.
That unsocial doesn’t mean anything, however. They’re DeCA stores… of people they’re successful a DeCA accommodation document.
What matters is what the strategy actually does.
With immoderate cursory control+F digging done DeCA’s titillating refrigeration engineering specifications, bingo.
“Defrost shall beryllium controlled done the RMCS”
Which brings america backmost to Fort Huachuca.
Every freezer entered defrost mode.
The installation itself says the powerfulness didn’t fail, and that defrost really heated the food.
DeCA’s ain engineering archiving says defrost is controlled done its refrigeration monitoring/control system.
Another DeCA refrigeration contract describes Refrigeration Monitoring and Control Systems (RMCS) located astatine individual commissaries whose refrigeration and HVAC alarms are monitored remotely 24/7.
Per the contract, the contractor was required to support a “master power strategy for each of the RMCS” somewhere successful the continental United States.
Important caveat, because this is wherever it’s really easy to jump up (spoken by a master jump-aheader): this does not mean personification astatine DeCA office tin remotely deed a proverbial DEFROST EVERY COMMISSARY button. It establishes centralized monitoring infrastructure.
Exactly really overmuch distant power exists, wherever existent maestro systems are hosted, and whether affected stores stock instrumentality remains unclear. Publicly disposable accusation is constricted here, and it’s not precisely a hotly discussed topic, arsenic you tin reasonably imagine.
But we tin found networked power astatine individual commissaries independently.
The contractor that allegedly built the newer commissary astatine Robins AFB, 1 of the installations pinch reported problems, describes the building arsenic having RSMS controls managing each of the store’s refrigeration and HVAC systems.
Again: centralized refrigeration power is not suspicious. It’s (apparently) really modern supermarkets work.
What it does is alteration the options for what a “freezer failure” tin mean.
At Holloman AFB, personification posted the printed announcement hastily taped to the blocked off, quiet refrigerated conception of their commissary:
A printed statement by Holloman AFB Commissary Management reads:
“Due to an unexpected refrigeration strategy failure, each chilled and stiff merchandise is temporarily unavailable for acquisition until further notice.”
The personification submitting the photographs said they’d knowledgeable powerfulness outages location before, but this arena took retired all of the refrigeration systems.
The motion and quiet cases are considerably harder to reason with.
Fort Irwin publically acknowledged its refrigeration problem arsenic well, pinch akin DIY signage and bare shelving visible.
Naval Station Newport besides officially announced restricted commissary income owed to refrigeration-system issues, nevertheless they opted to spell pinch a (dated?) image of afloat stocked shelves. I admit the variety.
Then there’s Dyess AFB, wherever different poster supplied a photograph taken that greeting showing an full commissary nutrient lawsuit emptied and closed disconnected aft personification reported that the Dyess commissary refrigeration was down.
Robins customers reported nutrient and nutrient being covered and unavailable.
Little Rock gets stranger.
A section organization page reported that the commissary’s refrigerated systems went down astatine astir 2 a.m., affecting chilled, refrigerated and stiff merchandise.
Then an anonymous submission to a ample Air Force organization page claimed:
“I overheard labor discussing that the strategy was hacked past night”
Do I cognize that those labor really said that?
Nope.
Do I cognize whether the labor would cognize the origin moreover if they did?
Also no.
Columbus AFB issued an charismatic announcement acknowledging freezer and chillers knowledgeable an outage.
The charismatic DeCA page for Travis AFB posted an August 26 notice stating that “refrigeration issues” had made immoderate stiff and chilled items unavailable and temporarily affected Click2Go operations.
Moving south, F.E. Warren AFB acknowledged a malfunction arsenic well.
In summation to the charismatic statement, I recovered an anonymous submission to a celebrated subject societal media page from personification claiming to activity astatine the F.E. Warren commissary. They wrote that its freezers, and apparently those astatine 14 different bases, “quit moving aliases reversed to heating.”
The commenter claimed 1 deli freezer registered 180 degrees and different 160.
I person nary thought what those numbers mean. Case temperature? Defrost heater? I americium emphatically not reporting that nutrient reached 180°F, but the “14 different bases” portion stuck out.
Because erstwhile I started counting, I sewage the aforesaid number.
On August 9, 2026, business cybersecurity researchers astatine Claroty’s Team82 published an article titled “Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities successful Danfoss Refrigeration Controllers.”
Yes, that is the existent title.
The researchers examined the Danfoss AK-SM 800A, a supervisory controller utilized to centrally negociate commercialized refrigeration systems. And what did they find?
Vulnerabilities tin of allowing serious unauthorized access.
Before anyone screenshots that paragraph and runs distant pinch it:
I person not established that Fort Huachuca uses a Danfoss AK-SM 800A.
I have, however, recovered a searchable transcript of a DeCA instrumentality inventory list identifying a Danfoss AK-SM880 refrigeration monitoring/control strategy astatine NAF El Centro - notably, not 1 of the commissaries connected my affected list.
So, Danfoss AK-SM exertion exists wrong the DeCA environment.
Interesting, but not attribution.
Claroty published a 2nd refrigeration investigation connected the same day, this time, astir thing called the Copeland XWEB Pro supervisory controller ($5,509 + shipping, successful lawsuit you’re successful the market; adjacent warning, this isn’t precisely a glowing income pitch).
They recovered 23 vulnerabilities, 21 rated ‘high severity’, and yet demonstrated the portion I really attraction about: After compromising the supervisory controller, they could physically manipulate the refrigeration equipment.
Copeland itself already issued a security bulletin acknowledging vulnerabilities and explicitly advising customers never to expose the power strategy aliases its web interface to the broader internet.
So: Can personification really hack a commercialized refrigeration controller and make it do things?
Yes.
No. Too early to telephone it that.
And this is wherever I americium presently stuck.
A communal package aliases configuration problem, update-gone-wrong, a communications failure, aliases immoderate boring DeCA-wide attraction rumor could explicate it too.
A bunch of unrelated aging refrigeration systems deciding to disconnected themselves during August is besides not precisely unimaginable. DeCA’s ain March procurement specifically identified aging infrastructure arsenic thing it is trying to manage. If you’ve ever shopped astatine a commissary, you tin attest to the truth that the accommodation are not what I would telephone top of the line boutique shopping experiences.
There are besides humanities examples of commissary refrigeration outages. Refrigeration instrumentality does, successful fact, break.
But the point I can’t get past is Fort Huachuca’s nonaccomplishment mode.
Not: the freezer compressor died.
Not: the powerfulness went out.
Not even: the refrigeration strategy stopped cooling.
Every freezer went into progressive defrost.
The usability that did it, per DeCA’s ain engineering documents, is controlled done the RMCS.
This is not impervious of a cyberattack, but it is rather a bid of coincidences.
There is still nary nationalist grounds that the affected stores stock the aforesaid RMCS vendor, controller, firmware, contractor, aliases network.
This is wherever we person to talk astir the Internet of Things (IoT), because if I had to deliberation astir really the net useful wrong a grocery-store freezer today, you do too.
We’ve spent years connecting everything to networks because, obviously, being capable to show and power worldly remotely is convenient. We’ve seen Wall-E.
Your printer, camera, washing machine, smart ring, toothbrush, car, and so many much create the IoT. In-store refrigeration systems are, apparently, besides things that we person connected to computers. How progressive.
The con? Every clip we make an entity web accessible, we create a imaginable measurement to utilization it.
Remember that Copeland experiment from backmost yonder? Once Claroty compromised the supervisory controller, they could remotely group the compressors, cooling fans, aliases defrost cycle, heating aliases cooling what’s inside.
That is the important part.
The machine doesn’t person to “hack” the freezer successful immoderate sci-fi sense. The machine is supposed to show the freezer what to do.
Claroty’s abstracted Danfoss investigation recovered information bypass and distant vulnerabilities successful different commercialized refrigeration controller, positive thousands of its guidance interfaces exposed to the nationalist internet.
Again, none of this is proven to beryllium connected to DeCA.
I look to person picked an exceptionally timely week to go concerned astir business controllers.
On August 19, only 8 days earlier Ft. Huachuca announced its freezer failure, the NSA and its partners warned that cyber actors are presently conducting “targeted reconnaissance and capacity development” against U.S.-based business controllers. Targets see energy, water, manufacturing, nutrient accumulation and commercialized facilities.
Their interest is besides physical: successful exploitation could origin equipment damage, downtime, imaginable harm to wellness and life, arsenic good arsenic disruption of business processes.
Different equipment. No demonstrated relationship to DeCA.
But suddenly, my interest astir computers making beingness equipment, ya know, do things feels exceptionally timely.
This is wherever my silly small freezer saga collides pinch actual nationalist security.
The 2026 National Defense Strategy identifies cyber capabilities among the increasing nonstop threats to the American homeland.
In June, the Department of Energy warned that nation-state adversaries are actively pre-positioning wrong U.S. critical-infrastructure networks, while different actors progressively target the OT/industrial-control systems that make beingness instrumentality do things.
Obviously, losing stiff meals is not the aforesaid arsenic losing the powerfulness grid.
But network-connected package controlling beingness infrastructure?
Same information problem, considerably little stakes.
There is simply a anticipation my security-trained encephalon can’t tune retired erstwhile reasoning astir what the intent of an incident for illustration this could be.
Well, we already cognize 1 reply is successful the playbook: Reconnaissance and pre-positioning.
A 2024 Joint Cybersecurity Advisory from CISA, NSA, FBI and world partners concluded with precocious confidence that Chinese-sponsored ‘Volt Typhoon’ hackers were positioning themselves wrong U.S. captious infrastructure networks.
Why?
To alteration early disruption.
The agencies confirmed compromises crossed communications, energy, proscription and h2o systems. The hackers gained access, and past conducted extended reconnaissance to understand unfortunate networks. In immoderate instances, they maintained entree for astatine slightest 5 years.
That sounds considerably little theoretical.
I americium perfectly not saying China hacked the commissaries.
But if this yet proves to beryllium a cyber incident alternatively than a mundane hardware failure, the national-security mobility wouldn’t conscionable beryllium who wants to ruin stiff pizzas?
It would beryllium whether the refrigeration failures had thing to do pinch entree to a mundane portion of network-connected infrastructure operated by a DoD agency, and if so, what the intent of that entree was.
A freezer is comparatively low-stakes. Access controls, utilities, HVAC, h2o systems? Not truthful much. Different systems, obviously, but the aforesaid broader information problem: beingness infrastructure sitting down network-connected controls.
Speculative, but not an wholly hypothetical threat.
Because the timing of this each wasn’t already overseas enough: On August 26, the DOJ and FBI announced the seizure of infrastructure belonging to a PRC state-sponsored hacking group, QTFY.
The NSA advisory released alongside it is possibly moreover much interesting.
QTFY’s QScan wasn’t simply infecting IoT devices. NSA describes it arsenic a reconnaissance and exploitation level utilized to find vulnerabilities successful networks, while QTFY utilized compromised IoT devices themselves to disguise consequent hacking activity.
The group has targeted the Defense Industrial Base, and DOJ says targets included NASA, DOE, the Federal Reserve, DOJ and the U.S. Senate, alongside powerfulness companies and defense contractors.
Its customers? China’s Ministry of State Security and PLA, among others.
Again: zero grounds connects QTFY to DeCA.
But two days ago, connected August 26th, the NSA was rather virtually informing astir a PRC state-sponsored group utilizing IoT devices and vulnerability-scanning devices to target military-adjacent and captious infrastructure networks.
So, forgive maine for continuing to person questions astir the freezers.
I decided to workout my God and country-given correct and inquire for the boring paperwork, which I’m judge will beryllium produced to maine successful a timely and reasonable fashion.
/s, of course
I’ve put together requests to DeCA for the Fort Huachuca refrigeration activity order, RMCS alarm/event records, attraction findings, and immoderate root-cause determination exists.
I’m besides requesting records concerning whether DeCA identified a communal method problem affecting aggregate commissaries during August - including network, controller, software/configuration, aliases cybersecurity incidents.
Most importantly, I want the instrumentality inventory. DeCA maintains remarkably elaborate instrumentality records, and ideally I tin get my paws connected the RMCS/controller shaper and exemplary for every commissary, not simply those connected my list.
Because then, this becomes testable.
If affected commissaries disproportionately stock a controller, firmware iteration, contractor, aliases caller change? That becomes rather interesting.
If 90% of DeCA uses the aforesaid controller, uncovering it astatine affected stores tells america fundamentally nothing.
And, if the attraction logs travel backmost relay failed/compressor died/lost refrigerant/blown fuse crossed unrelated stores, my small mentation dies an appropriately boring decease and I statesman my apology tour.
Sorry successful beforehand (just successful case).
For correct now, “DeCA was hacked” is not a substantive capable statement to make, nevertheless I'd beryllium lying if I said it wasn’t still my hunch.
Publicly, I'm not 1 for frivolous claims. So I'll return disconnected my tin chapeau for you, beloved reader, and instrumentality to what is supported:
At slightest six subject installations crossed the state person now officially acknowledged refrigeration/freezer failures aliases important refrigeration issues during the aforesaid wide period, pinch further incidents reported elsewhere. At slightest 1 progressive every freezer entering a defrost authorities while powerfulness remained on; DeCA engineering specifications authorities that defrost is controlled done the RMCS. A cybersecurity incident remains a plausible hypothesis, but location is not yet capable grounds to support that fact.
So, that was today’s heavy dive. This is possibly the longest my encephalon has idled connected refrigeration-related topics. Unfortunately, I request the authorities to reply my FOIA petition successful bid to free myself from The Pointed Questions That Persist, arsenic I telephone them… and we each cognize really quickly that goes.
As I stood successful beforehand of my ain freezer while making dinner, I caught myself pondering the web information risks of those ridiculous fridges pinch the integrated wifi-enabled touchscreens.
Every day, I tie person to becoming a luddite.
Chat soon,
M. Elizabeth
August 29:
A Fort Irwin Facebook post says DeCA and Ft. Irwin techs are still moving to repair the commissary’s refrigerators and freezers, describing the rumor arsenic portion of a “situation that has impacted market stores crossed the country.” It is unclear whether the installation is referring specifically to commissaries, aliases market stores much broadly based connected wording.
A Port Hueneme shopper confirmed to maine photos showing quiet cases were taken Aug. 27, while a commissary worker confirmed by telephone that the store’s refrigeration remains offline without a known restoration date.
A Dyess AFB commissary worker confirmed by telephone refrigerators were moving and stocked, but being monitored closely.
Aug. 28, 2026:
I’ve submitted 3 FOIA requests to DeCA seeking Fort Huachuca’s RMCS event/alarm logs, activity orders and root-cause findings; records concerning immoderate communal origin among the caller refrigeration failures; and DeCA’s existing inventory of RMCS/refrigeration-controller instrumentality crossed commissary locations.
Updated to see DeCA’s Aug. 26 announcement confirming refrigeration issues affecting stiff and chilled inventory astatine Travis AFB Commissary. The confirmed count is now six installations.
Fort Meade remains unverified. A root who visited the commissary Aug. 28 recovered the commissary operating normally; I person not independently confirmed the earlier reported outage.
DeCA’s Camp Lejeune page now reports a “service outage of respective freezer units” and says the commissary is moving pinch DeCA Headquarters to bring the units backmost online, nevertheless this announcement appears to beryllium connected a dated, duplicated DeCA tract (old, new). Removed from count, confirmed full remains astatine six.
DeCA MCB Camp Lejeune commissary page, accessed Aug. 28, 2026.
I received an (unverified) extremity that Port Hueneme’s refrigeration is besides disrupted. No charismatic confirmation discovered.
Fort Irwin’s Facebook post states “Working diligently to troubleshoot and resoluteness the refrigeration issues…no estimated clip for completion”
The Pentagon has now acknowledged a broader problem, telling Military Times that DoD is alert of a “possible refrigeration disruption astatine immoderate Defense Commissary Agency commissaries.” Officials person not disclosed the origin aliases whether the incidents are connected
Earlier reporting: Stars and Stripes (attributes this investigation)
Earlier successful the year, DeCA signed incumbent attraction contractors were retained for the mostly of Commissary location done 2026 because of their store-specific knowledge of humanities maintenance, repairs and replacements…knowledge that whitethorn reasonably besides reside pinch sub/local contractors partners moving nether those premier contractors.
Stars and Stripes said pinch Aldevra, a DeCA refrigeration vendor, which said it received nary work calls related to the outages, and that the refrigerators it supplies to DeCA aren’t network-connected themselves, though abstracted remote-monitoring systems tin beryllium added (as suspected). This reinforces a connectivity mentation and reduces likelihood of a large-scale beingness hardware malfunction.
An anonymous inbox sent to @AFamnncosnco alleges a refrigeration incident astatine Vance AFB (Unconfirmed). No nationalist connection by charismatic sources disposable astatine this time.
A NAS Lemoore commissary worker confirmed by telephone that its refrigeration strategy returned to normal cognition coming (Aug. 28).
Further Reporting:
Stars and Stripes
NavyTimes
English (US) · 
Indonesian (ID) · 
