Defense Commissary Agency refrigeration disruption

Analyst assessment

DysruptionHub assesses with high confidence that refrigeration failures disrupted Defense Commissary Agency stores in multiple states beginning Aug. 26, 2026. Military Times documented official effects at seven commissaries. Our reporting identified public reports of refrigeration problems at at least 14 commissaries across 10 states. Pentagon Press Operations described it as a “possible refrigeration disruption” in a response attributable on background to a War Department official. The official said DeCA transferred temperature-sensitive products to alternate temperature-controlled locations, that commissaries remained open and that precautions were being taken to protect food safety. The response did not identify a cause, say whether the incidents were linked or address possible malicious activity.

Evidence quality varies by site. Official notices and primary images support several locations, while McConnell and Cannon Air Force bases remain low-confidence attributed reports because neither Signal and Silence nor another reviewed source published location-specific evidence for them.

Cyber involvement is suspected. DysruptionHub assesses it is likely, with medium confidence, that malicious or unauthorized cyber activity contributed to the disruption. The judgment rests on the tight multistate cluster, Fort Huachuca’s report that every freezer entered defrost mode while power remained on and DeCA records documenting networked refrigeration monitoring and control across commissaries. A DeCA maintenance task order requires continuous monitoring of refrigeration and heating, ventilation and air conditioning alarms generated by Remote Monitoring Control Systems at U.S. and territorial facilities, with a master monitoring system in the continental United States. Our reporting also found DeCA engineering guidance stating that the RMCS manages defrost cycles, stages compressors and regulates condenser fans.

That architecture establishes a technically plausible path for distributed control effects, not proof of an intrusion. The public records do not show that the affected commissaries shared infrastructure or that the master system could send commands to stores. A software or configuration error, communications failure, shared contractor action or maintenance problem could create a similar pattern without malicious access. Those alternatives remain plausible, but the reviewed evidence does not support treating any of them as more likely than cyber activity. Neither a malicious nor nonmalicious common cause is confirmed.

Operational significance

The failures reduced grocery availability for military personnel, families and eligible retirees. Naval Station Newport restricted sales to dry goods and suspended deli, sushi and grab-and-go service. Fort Irwin stopped selling milk and eggs before limiting sales to dry goods. Fort Huachuca said all frozen food spoiled after every freezer entered defrost mode. The Travis Air Force Base commissary reported unavailable frozen and chilled products and temporarily closed Click2Go because of limited inventory.

The Pentagon response said DeCA transferred temperature-sensitive products to alternate temperature-controlled locations, that commissaries remained open and that all possible measures were being taken to protect food safety. These effects establish disrupted retail operations, restricted access to refrigerated and frozen products, degraded service and a food-safety hazard. The evidence does not support a nationwide commissary outage, base closure, payment disruption or broader military mission impact.

Related operational-technology activity

The event occurred about a month after the Late July 2026 PLC Attacks, which involved malicious activity against internet-facing programmable logic controllers at U.S. water and wastewater utilities. The comparison is relevant because both concern networked operational technology and physical-process disruption at geographically separated sites.

The public record does not establish that the DeCA event belongs to that campaign. The commissary failures occurred outside the campaign’s July 26-31 observed window, involved a different sector and have no publicly shared device, vendor, access path, indicator or actor. DysruptionHub does not assess this incident as a campaign member on the available evidence.

Comparison with French supermarket refrigeration attacks

The October 2026 attacks on French supermarket refrigeration systems provide a concrete comparison for the commissary failures. Reuters reported that attackers disrupted connected refrigeration at hundreds of stores, causing food spoilage, and explicitly compared those effects with the late-August U.S. military commissary losses. The French attacks occurred weeks after DeCA’s disruption.

In an alert issued Oct. 12 and expanded Oct. 13, France’s CERT-FR reported compromises of Danfoss AK-SC and AK-SM, Copeland xweb and Dixell xweb refrigeration controllers. It advised operators to remove internet exposure, check configurations — particularly defrost schedules — and restore remote access only through a secure VPN or protected network. These findings illustrate how unauthorized control changes can interrupt refrigeration and damage inventory.

There is a documented manufacturer and product-family overlap in DeCA’s design standards. Its refrigeration monitoring and control guide specification names Danfoss AK-SM 800A and Resource Data Management PR0510 as basis-of-design options, with approved equivalents permitted. The Danfoss option falls within the AK-SM family identified in the French alert. The specification also calls for browser-based remote access, remotely initiated manual defrost, group defrost schedules, temporary suppression of alarms during defrost and recovery, and audit logs of changes and overrides. These requirements make refrigeration-control access and configuration relevant to the investigation, but they do not establish which controllers were installed at the affected commissaries or how those systems were configured.

For DeCA, the comparison makes refrigeration-controller access and defrost settings relevant investigative questions, particularly given Fort Huachuca’s report that every freezer entered defrost mode while power remained on. It demonstrates a feasible type of attack, but does not establish that the commissary failures resulted from the same technique. Public evidence does not identify the controllers installed at the affected commissaries or establish a shared exploited vulnerability, access path, forensic indicator or actor. The French case does not resolve DeCA’s competing software, configuration, communications or maintenance explanations; cyber involvement remains suspected, with the existing likely assessment and medium confidence.

Current status

The operational disruption is presumed resolved. Fort Irwin reported refrigeration repairs completed Aug. 31 and began using emergency orders to replenish stock. No later dated continuing restriction tied to the August U.S. cluster was found as of Oct. 14. The live Travis store page displayed normal service hours, but that does not establish an agencywide restoration date. The investigation and whether malicious cyber activity caused a common disruption remain unresolved.

Confidence and uncertainty

Confidence is high in the documented refrigeration failures, product restrictions, transfers and spoilage because Defense Department, installation and DeCA store statements support those facts. Confidence is medium in the likely cyber judgment because the distributed pattern and RMCS architecture provide a coherent technical explanation, but the public record lacks forensic evidence and leaves credible nonmalicious alternatives.

Ransomware and threat-actor attribution remain unresolved. Searches for the Defense Commissary Agency, DeCA and commissaries.com found no stable ransomware or extortion victim claim tied to the disruption. The evidence does not support data theft, extortion, encryption or attribution to a named actor.

Analytic gaps

The public record does not identify the current RMCS host, monitoring provider, affected stores’ controller manufacturers and models, firmware versions, network topology, recent configuration changes, alarm sequences, maintenance findings or root-cause reports. It also does not establish whether the affected stores failed within one coordinated time window, how many commissaries were affected, how much inventory was lost or when every location restored full sales.