--- title: Refrigeration failures at multiple U.S. military... description: Refrigeration systems failed near-simultaneously at multiple U.S. military commissaries in late August 2026, including Fort Irwin, F.E. Warren AFB, Fort... canonical: https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Refrigeration failures at multiple U.S. military commissaries raise cyberattack questions | daily.dev og:description: Refrigeration systems failed near-simultaneously at multiple U.S. military commissaries in late August 2026, including Fort Irwin, F.E. Warren AFB, Fort... og:url: https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9 og:image: https://api.daily.dev/og/posts/YXFvQNhd9.png og:image:alt: Refrigeration failures at multiple U.S. military commissaries raise cyberattack questions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Refrigeration failures at multiple U.S. military commissaries raise cyberattack questions **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Refrigeration systems failed near-simultaneously at multiple U.S. military commissaries in late August 2026, including Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. At Fort Huachuca, freezers entered active defrost mode despite power staying on, ruling out a simple outage. The Pentagon confirmed a possible refrigeration disruption, and three military criminal investigative agencies, including a Cyber Field Office and DCIS, opened investigations. The suspicion stems partly from timing: weeks earlier, Claroty's Team82 disclosed serious vulnerabilities in the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers, plus thousands of exposed management interfaces reachable from the internet. No confirmed link exists yet between those flaws and the failures. The broader context includes NSA and CISA warnings about nation-state actors like Volt Typhoon and QTFY probing U.S. industrial control systems for pre-positioning ahead of a future crisis. Investigations remain ongoing and no cause has been confirmed. ## Content In late August 2026, refrigeration systems failed at multiple U.S. military commissaries in what looks, at minimum, like a suspicious coincidence. Affected bases include Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. At Fort Huachuca, freezers entered active defrost mode even though power stayed on — which rules out a simple outage. The Pentagon acknowledged "a possible refrigeration disruption" at multiple commissaries but declined to say more. Three military criminal investigative agencies have opened investigations, including a Cyber Field Office and the Defense Criminal Investigative Service (DCIS). ## What the systems look like The Defense Commissary Agency (DeCA) runs its refrigeration through networked Remote Monitoring Control Systems (RMCS). These aren't isolated units — they're managed centrally, which is convenient until it isn't. Here's where it gets uncomfortable: just weeks before the failures, Claroty's Team82 disclosed serious vulnerabilities in two widely-used refrigeration controllers — the Danfoss AK-SM 800A and the Copeland XWEB Pro. Their research also found thousands of exposed management interfaces for these systems reachable from the internet. No one has confirmed a connection between those vulnerabilities and what happened at the commissaries. But the timing is hard to ignore. ## The broader context This isn't happening in a vacuum. NSA and CISA have both warned in recent years about nation-state actors — specifically Volt Typhoon and a group tracked as QTFY — probing U.S. industrial control systems and critical infrastructure. The working theory in those warnings is pre-positioning: getting into systems now to cause disruption later, possibly during a crisis. Freezer failures at military commissaries aren't catastrophic on their own. But if the same access that defrosted the freezers could be used to disrupt fuel systems, water treatment, or base power during an actual conflict, that's a different conversation. ## What we don't know Nothing is confirmed yet. The simultaneous failures could have a mundane explanation — a shared software update, a vendor-side configuration change, something boring. The investigations are ongoing. But the combination of factors here — networked systems, recently disclosed vulnerabilities, near-simultaneous failures across geographically distant bases, and active investigations by military cyber units — makes the "probably fine" explanation feel thin. Worth watching. ## Questions this post answers ### What vulnerabilities did Claroty's Team82 find in the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers? Claroty's Team82 disclosed serious security vulnerabilities in both the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers shortly before a wave of unexplained refrigeration failures at several U.S. military commissaries. The same research also identified thousands of these controllers' management interfaces exposed and reachable directly from the internet, raising concerns about remote exploitation of industrial refrigeration systems. _Teams securing OT and refrigeration controllers can follow disclosures like this one on daily.dev before they turn into incidents._ ### What happened to refrigeration systems at US military bases in late August 2026? Refrigeration systems failed at multiple U.S. military commissaries near-simultaneously, affecting Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. At Fort Huachuca, freezers entered active defrost mode despite continuous power, ruling out a simple outage. The Pentagon acknowledged a possible refrigeration disruption, and three military criminal investigative agencies, including a Cyber Field Office and the Defense Criminal Investigative Service, opened investigations. _Anyone tracking critical infrastructure incidents can follow developments on this investigation via daily.dev._ ### Why are Volt Typhoon and QTFY relevant to US critical infrastructure security concerns? Volt Typhoon and a group tracked as QTFY are nation-state actors that NSA and CISA have warned are probing U.S. industrial control systems and critical infrastructure. The working theory behind these warnings is pre-positioning: gaining access to systems now so disruption can be triggered later, potentially timed to a future crisis or conflict. _Security teams monitoring nation-state ICS threats can stay ahead of pre-positioning campaigns via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 482 comments across lobsters, hackernews (as of 2026-09-03). **TL;DR:** Discussion is dominated by skepticism that this was a deliberate hack, with many pointing to misconfiguration or a bad update as more plausible, alongside broader tangents about military logistics, PLC/ICS security practices, and an extended geopolitical argument about Iran that drifted far from the original topic. **Sentiment:** 5% positive · 40% mixed · 55% skeptical **The case for** - Some acknowledge the timing of the vulnerability disclosure alongside the outages is at least worth noting as suspicious. - One commenter notes that even if not malicious, the incident is useful evidence that these freezer systems can be remotely controlled at scale, which is itself concerning. **The pushback** - Multiple experienced commenters argue a misconfiguration or bad update is far more likely than a coordinated hack. - Commenters point out industrial PLCs and refrigeration controllers are notoriously under-secured (default admin/admin credentials, no TLS, engineers with no security background). - Some argue the framing as a 'military freezers hacked' story is misleading/bad journalism when the real issue is widespread insecure refrigeration controllers across many vendors. - Skepticism that simultaneous mechanical failures across many sites, is unusual, since similar parts can fail around the same time (compared to aviation maintenance patterns). - Concerns raised about network segmation failing in practice, as air-gapped industrial networks often get bridged accidentally over time. **By community** - lobsters (mixed): No comment content was provided, so no discernible take on this provider. - hackernews (skeptical): Most technically-informed commenters doubt a deliberate hack and instead suspect misconfiguration or a bad update, while a large side conversation about industrial control system insecurity and an unrelated Iran conflict debate dominated the thread. **Hottest debate:** Whether the outages represent a genuine cyberattack versus a mundane misconfiguration/update failure, with a tangential and heated argument breaking out over the separate Iran conflict and its logistics implications. **Open questions** - How many commissary refrigeration units exist in total, and what fraction are experiencing problems, to gauge whether this is statistically unusual? - Was there a common firmware/hardware batch or maintenance window shared across the affected sites that could explain simultaneous failures? - Why are these freezer control systems remotely accessible/manageable over the internet at all, rather than just monitored? **Highlights** > As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overseas locations where this would have ripple effects in the local economy. Guam specifically would cause catastrophic supply shortages, since DeCA probably supplies around 50% of the groceries on that island (that's a WAG based on my time there). > — [CobaltFire on hackernews · 9 comments](https://news.ycombinator.com/item?id=49513067) > The author doesn't really claim it was a hack, just that it is a possibility. But they are charging down the path of the potential hack before asking the more obvious question: How many refrigerators exist in the military at all? And of those, how many are having problems? Because a half dozen a day sounds plausible as standard maintenance issues, as the author acknowledges. If it were a hack, I'd expect something like 50% of them to have problems. But not knowing how many there are, I don't know how significant these incidents really are. > — [codingdave on hackernews · 4 comments](https://news.ycombinator.com/item?id=49508647) > That is also likely true, i.e., misconfiguration, but this is not a "military freezers hacked" story, it is a story of many different controllers of many different refrigeration company products being "hacked" through the humongous barn doors they all have wide open. It's really just bad journalism. > — [tyrabound on hackernews](https://news.ycombinator.com/item?id=49521546) > This points to either an inside job (a US gov agency that feels it needs to create urgency) or Iran (that has an urgent need to do something), since no serious adversary would use this capability in the absence of a theater. > — [wjnc on hackernews · 1 comments](https://news.ycombinator.com/item?id=49519306) > A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on the thing (user/pass eg admin/admin was their usual). Anecdote: I once spent hours reading the docs and clicking around trying to get it to accept an SSL certificate signed by a real CA and it wouldn’t go, but it accepted one I self-signed in openssl. In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind. > — [peterabbitcook on hackernews · 5 comments](https://news.ycombinator.com/item?id=49509011) **Source threads** - [lobsters](https://lobste.rs/s/ygjo0g/i_think_military_commissary_freezers) · 20 points · 8 comments - [hackernews](https://news.ycombinator.com/item?id=49508506) · 397 points · 474 comments ## Similar posts on daily.dev - [Critical infrastructure’s long, undefended tail exposed by UK energy attack](https://daily.dev/posts/critical-infrastructure-s-long-undefended-tail-exposed-by-uk-energy-attack-hajfwhwyk) · CSO Online · 0 upvotes · 0 comments - [Iran Alleges US Networking Gear Was Deliberately Disabled](https://daily.dev/posts/iran-alleges-us-networking-gear-was-deliberately-disabled-erflmtyyt) · Security Boulevard · 1 upvotes · 0 comments - [What we know about the alleged Iranian hacks on US water utilities](https://daily.dev/posts/what-we-know-about-the-alleged-iranian-hacks-on-us-water-utilities-ppbezomds) · TechCrunch · 21 upvotes · 3 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Refrigeration failures at multiple U.S. military commissaries raise cyberattack questions","url":"https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9"},"datePublished":"2026-09-03T11:51:32.037Z","dateModified":"2026-09-03T11:52:19.942Z","description":"Refrigeration systems failed near-simultaneously at multiple U.S. military commissaries in late August 2026, including Fort Irwin, F.E. Warren AFB, Fort...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/985a8d0b0c096c8c04a41cb0ce318b77?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/985a8d0b0c096c8c04a41cb0ce318b77?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Refrigeration failures at multiple U.S. military commissaries raise cyberattack questions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/refrigeration-failures-at-multiple-u-s-military-commissaries-raise-cyberattack-questions-yxfvqnhd9#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities did Claroty's Team82 find in the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers?","acceptedAnswer":{"@type":"Answer","text":"Claroty's Team82 disclosed serious security vulnerabilities in both the Danfoss AK-SM 800A and Copeland XWEB Pro refrigeration controllers shortly before a wave of unexplained refrigeration failures at several U.S. military commissaries. The same research also identified thousands of these controllers' management interfaces exposed and reachable directly from the internet, raising concerns about remote exploitation of industrial refrigeration systems. Teams securing OT and refrigeration controllers can follow disclosures like this one on daily.dev before they turn into incidents."}},{"@type":"Question","name":"What happened to refrigeration systems at US military bases in late August 2026?","acceptedAnswer":{"@type":"Answer","text":"Refrigeration systems failed at multiple U.S. military commissaries near-simultaneously, affecting Fort Irwin, F.E. Warren AFB, Fort Huachuca, Naval Station Newport, Columbus AFB, Travis AFB, and Naval Air Station Lemoore. At Fort Huachuca, freezers entered active defrost mode despite continuous power, ruling out a simple outage. The Pentagon acknowledged a possible refrigeration disruption, and three military criminal investigative agencies, including a Cyber Field Office and the Defense Criminal Investigative Service, opened investigations. Anyone tracking critical infrastructure incidents can follow developments on this investigation via daily.dev."}},{"@type":"Question","name":"Why are Volt Typhoon and QTFY relevant to US critical infrastructure security concerns?","acceptedAnswer":{"@type":"Answer","text":"Volt Typhoon and a group tracked as QTFY are nation-state actors that NSA and CISA have warned are probing U.S. industrial control systems and critical infrastructure. The working theory behind these warnings is pre-positioning: gaining access to systems now so disruption can be triggered later, potentially timed to a future crisis or conflict. Security teams monitoring nation-state ICS threats can stay ahead of pre-positioning campaigns via daily.dev."}}]} ```