--- title: I Think the Military Commissary Freezers Were Hacked description: A wave of near-simultaneous refrigeration failures hit at least six (and possibly more) U.S. military commissaries in late August 2026, with freezers at Fort... canonical: https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I Think the Military Commissary Freezers Were Hacked | daily.dev og:description: A wave of near-simultaneous refrigeration failures hit at least six (and possibly more) U.S. military commissaries in late August 2026, with freezers at Fort... og:url: https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s og:image: https://api.daily.dev/og/posts/S73ggSG8S.png og:image:alt: I Think the Military Commissary Freezers Were Hacked og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I Think the Military Commissary Freezers Were Hacked **[Lobsters](https://daily.dev/sources/lobsters)** · 20 min read · 0 upvotes · 0 comments ## Summary A wave of near-simultaneous refrigeration failures hit at least six (and possibly more) U.S. military commissaries in late August 2026, with freezers at Fort Huachuca entering active defrost mode despite power remaining on. The investigation traces DeCA's refrigeration systems to networked Remote Monitoring Control Systems (RMCS), and highlights that Claroty's Team82 disclosed serious vulnerabilities in Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers just weeks earlier, including thousands of exposed management interfaces. No evidence yet confirms a cyberattack, but three military criminal investigative agencies, including a Cyber Field Office and DCIS, have opened investigations, and the Pentagon has acknowledged a 'possible refrigeration disruption' at multiple commissaries. The piece situates the incident against NSA/CISA warnings about nation-state actors (Volt Typhoon, QTFY) probing U.S. industrial control systems and critical infrastructure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities did researchers find in the Danfoss AK-SM 800A refrigeration controller? Claroty's Team82 published research on August 9, 2026 uncovering vulnerabilities in the Danfoss AK-SM 800A, a supervisory controller used to centrally manage commercial refrigeration systems, that could allow serious unauthorized access. The same research also found thousands of these controllers' management interfaces exposed to the public internet. _Track emerging OT and IoT vulnerability disclosures like this one on daily.dev as they reshape infrastructure security priorities._ ### What did Claroty find wrong with the Copeland XWEB Pro controller? Claroty's Team82 identified 23 vulnerabilities in the Copeland XWEB Pro supervisory controller, with 21 rated high severity, and demonstrated that after compromising the controller an attacker could physically manipulate connected refrigeration equipment, such as compressors, cooling fans, and defrost cycles. Copeland issued a security bulletin advising customers never to expose the control system or its web interface to the internet. _Developers securing industrial control interfaces can follow disclosures like this on daily.dev before they turn into incidents._ ### What happened to the freezers at Fort Huachuca's military commissary in August 2026? Every freezer at the Fort Huachuca commissary entered active defrost mode overnight on August 27, 2026, which heated rather than simply stopped cooling the food, despite the base confirming power did not go out. DeCA's own refrigeration engineering specifications state that defrost is controlled through the Remote Monitoring Control System (RMCS), raising questions about a possible network-based cause rather than a simple hardware failure. _Anyone tracking how ICS incidents unfold in real time can follow ongoing infrastructure security stories on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 482 comments across lobsters, hackernews (as of 2026-09-03). **TL;DR:** Discussion is dominated by skepticism that this was a deliberate hack, with many pointing to misconfiguration or a bad update as more plausible, alongside broader tangents about military logistics, PLC/ICS security practices, and an extended geopolitical argument about Iran that drifted far from the original topic. **Sentiment:** 5% positive · 40% mixed · 55% skeptical **The case for** - Some acknowledge the timing of the vulnerability disclosure alongside the outages is at least worth noting as suspicious. - One commenter notes that even if not malicious, the incident is useful evidence that these freezer systems can be remotely controlled at scale, which is itself concerning. **The pushback** - Multiple experienced commenters argue a misconfiguration or bad update is far more likely than a coordinated hack. - Commenters point out industrial PLCs and refrigeration controllers are notoriously under-secured (default admin/admin credentials, no TLS, engineers with no security background). - Some argue the framing as a 'military freezers hacked' story is misleading/bad journalism when the real issue is widespread insecure refrigeration controllers across many vendors. - Skepticism that simultaneous mechanical failures across many sites, is unusual, since similar parts can fail around the same time (compared to aviation maintenance patterns). - Concerns raised about network segmation failing in practice, as air-gapped industrial networks often get bridged accidentally over time. **By community** - lobsters (mixed): No comment content was provided, so no discernible take on this provider. - hackernews (skeptical): Most technically-informed commenters doubt a deliberate hack and instead suspect misconfiguration or a bad update, while a large side conversation about industrial control system insecurity and an unrelated Iran conflict debate dominated the thread. **Hottest debate:** Whether the outages represent a genuine cyberattack versus a mundane misconfiguration/update failure, with a tangential and heated argument breaking out over the separate Iran conflict and its logistics implications. **Open questions** - How many commissary refrigeration units exist in total, and what fraction are experiencing problems, to gauge whether this is statistically unusual? - Was there a common firmware/hardware batch or maintenance window shared across the affected sites that could explain simultaneous failures? - Why are these freezer control systems remotely accessible/manageable over the internet at all, rather than just monitored? **Highlights** > As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overseas locations where this would have ripple effects in the local economy. Guam specifically would cause catastrophic supply shortages, since DeCA probably supplies around 50% of the groceries on that island (that's a WAG based on my time there). > — [CobaltFire on hackernews · 9 comments](https://news.ycombinator.com/item?id=49513067) > The author doesn't really claim it was a hack, just that it is a possibility. But they are charging down the path of the potential hack before asking the more obvious question: How many refrigerators exist in the military at all? And of those, how many are having problems? Because a half dozen a day sounds plausible as standard maintenance issues, as the author acknowledges. If it were a hack, I'd expect something like 50% of them to have problems. But not knowing how many there are, I don't know how significant these incidents really are. > — [codingdave on hackernews · 4 comments](https://news.ycombinator.com/item?id=49508647) > That is also likely true, i.e., misconfiguration, but this is not a "military freezers hacked" story, it is a story of many different controllers of many different refrigeration company products being "hacked" through the humongous barn doors they all have wide open. It's really just bad journalism. > — [tyrabound on hackernews](https://news.ycombinator.com/item?id=49521546) > This points to either an inside job (a US gov agency that feels it needs to create urgency) or Iran (that has an urgent need to do something), since no serious adversary would use this capability in the absence of a theater. > — [wjnc on hackernews · 1 comments](https://news.ycombinator.com/item?id=49519306) > A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on the thing (user/pass eg admin/admin was their usual). Anecdote: I once spent hours reading the docs and clicking around trying to get it to accept an SSL certificate signed by a real CA and it wouldn’t go, but it accepted one I self-signed in openssl. In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind. > — [peterabbitcook on hackernews · 5 comments](https://news.ycombinator.com/item?id=49509011) **Source threads** - [lobsters](https://lobste.rs/s/ygjo0g/i_think_military_commissary_freezers) · 20 points · 8 comments - [hackernews](https://news.ycombinator.com/item?id=49508506) · 397 points · 474 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I Think the Military Commissary Freezers Were Hacked","url":"https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s"},"datePublished":"2026-09-03T11:50:43.959Z","dateModified":"2026-09-03T11:52:04.158Z","description":"A wave of near-simultaneous refrigeration failures hit at least six (and possibly more) U.S. military commissaries in late August 2026, with freezers at Fort...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/985a8d0b0c096c8c04a41cb0ce318b77?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/985a8d0b0c096c8c04a41cb0ce318b77?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT20M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"I Think the Military Commissary Freezers Were Hacked"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/i-think-the-military-commissary-freezers-were-hacked-s73ggsg8s#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities did researchers find in the Danfoss AK-SM 800A refrigeration controller?","acceptedAnswer":{"@type":"Answer","text":"Claroty's Team82 published research on August 9, 2026 uncovering vulnerabilities in the Danfoss AK-SM 800A, a supervisory controller used to centrally manage commercial refrigeration systems, that could allow serious unauthorized access. The same research also found thousands of these controllers' management interfaces exposed to the public internet. Track emerging OT and IoT vulnerability disclosures like this one on daily.dev as they reshape infrastructure security priorities."}},{"@type":"Question","name":"What did Claroty find wrong with the Copeland XWEB Pro controller?","acceptedAnswer":{"@type":"Answer","text":"Claroty's Team82 identified 23 vulnerabilities in the Copeland XWEB Pro supervisory controller, with 21 rated high severity, and demonstrated that after compromising the controller an attacker could physically manipulate connected refrigeration equipment, such as compressors, cooling fans, and defrost cycles. Copeland issued a security bulletin advising customers never to expose the control system or its web interface to the internet. Developers securing industrial control interfaces can follow disclosures like this on daily.dev before they turn into incidents."}},{"@type":"Question","name":"What happened to the freezers at Fort Huachuca's military commissary in August 2026?","acceptedAnswer":{"@type":"Answer","text":"Every freezer at the Fort Huachuca commissary entered active defrost mode overnight on August 27, 2026, which heated rather than simply stopped cooling the food, despite the base confirming power did not go out. DeCA's own refrigeration engineering specifications state that defrost is controlled through the Remote Monitoring Control System (RMCS), raising questions about a possible network-based cause rather than a simple hardware failure. Anyone tracking how ICS incidents unfold in real time can follow ongoing infrastructure security stories on daily.dev."}}]} ```