You can spend billions defending a military installation and still have to ask who left the grocery-store freezer connected to the internet.
That question deserves an answer after cyberattacks on European refrigeration systems—and unexplained outages at American military commissaries.
First, keep the facts straight: The Pentagon has not publicly confirmed that hackers caused the U.S. commissary failures. An investigation is underway. Similar failures on opposite sides of the Atlantic do not, by themselves, establish a common cause.
But what happened in Europe should get every commander’s attention.
Attackers reached the electronic controls that manage commercial refrigeration and changed how the equipment operated. Food warmed. Inventory became garbage. Stores lost money, and customers faced empty refrigerated cases. France’s cybersecurity agency confirmed numerous controller compromises in October. Another wave hit European retailers Nov. 2.
Nobody needed to blow a hole in a warehouse.
They reached the controls.
Commercial refrigeration systems increasingly allow technicians to monitor temperatures and troubleshoot equipment remotely. That is useful when a mechanic can diagnose a problem without driving across town.
It is considerably less useful when an intruder can get in.
Security researchers at Claroty say exposed management interfaces and factory-default passwords have allowed attackers to manipulate refrigeration functions, including defrost controls. The researchers also caution that the particular software vulnerabilities used in these attacks have not been officially established.
A freezer full of ruined meat is a blunt demonstration of what happens when someone gains control of machinery from a keyboard.
Now consider the commissaries.
In late August, at least six U.S. military bases or stores publicly reported refrigeration outages. Meat, dairy products, produce and frozen foods were affected. Two months later, the Pentagon still has not publicly explained what caused the failures, provided a definitive count of affected stores or disclosed the cost of the food lost, according to Stars and Stripes. Army criminal investigators and the Defense Criminal Investigative Service are examining the outages and coordinating with French authorities about the incidents there.
Investigators need room to work. Nobody should demand that they publish evidence that would compromise the case.
But military families also deserve a useful accounting of what happened to a service they depend on.
How many stores lost refrigeration? How much food went into the trash? What has been done to prevent another failure?
Those questions stand whether the cause was a hacker, a maintenance problem or something else.
There is already an important distinction in the record. Four commissaries in Germany and England experienced refrigeration failures in September.
France’s cybersecurity agency has advised operators to remove publicly exposed refrigeration controllers from internet access. Some European retailers have disconnected affected systems while reviewing their networks.
For commissaries, the security questions are plain enough for any commander to understand.
Who can reach the controls? Who authorizes that access? Who checks the contractors? Who receives an alarm when temperatures rise—and how quickly can someone act?
These are questions about responsibility. They should have names attached to the answers.
A commissary outage is not the same as losing a military supply depot. But the European attacks demonstrate how interference with ordinary equipment can destroy supplies and interrupt daily life. The families buying groceries experience the consequences long before an investigation produces its final report.
We teach commanders to protect their supplies, maintain their equipment and look after their people.
That responsibility extends to the machinery keeping the food cold.
The Pentagon still owes an explanation for August. Whatever investigators find, somebody needs to make sure the next person changing a commissary’s freezer settings is supposed to be there.