Refrigeration failures disrupted military commissaries across multiple states last week, restricting chilled and frozen food sales, suspending online ordering and spoiling inventory at some stores.
The Department of Defense, which the administration also calls the War Department, acknowledged the disruption in a written response to DysruptionHub Tuesday. A War Department official said DeCA transferred temperature-sensitive products to alternate temperature-controlled locations to limit losses, that commissaries remained open and that the agency was taking precautions to protect food safety.
The multistate pattern raised questions about whether a cyber incident played a role. The official did not answer questions about scope, cause, shared infrastructure or evidence of malicious activity, saying, “Beyond this we have nothing additional to provide.”
DysruptionHub identified public reports of refrigeration problems at at least 14 commissaries across 10 states, though officials had not provided a complete count. DeCA operates 235 commissaries worldwide for military personnel, retirees, disabled veterans and other authorized shoppers and their families, according to the agency. The commissary system is a military benefit that generally sells groceries at cost, plus a 5% surcharge, while taxpayer-funded appropriations cover operating expenses.
The effects varied by location. The Naval Station Newport commissary limited sales to dry goods, Fort Irwin stopped selling refrigerated products, and Fort Huachuca reported that every freezer entered defrost mode despite continuous power, spoiling its frozen inventory.
The Travis Air Force Base commissary in California said Aug. 26 that some frozen and chilled products were unavailable. It temporarily suspended its Click2Go ordering service because of limited inventory and expected products to return in stages through Aug. 29, with online ordering scheduled to resume Aug. 30.
Recovery also varied. LavX News reported that Newport resumed operations by Aug. 29 and Naval Air Station Lemoore returned to normal Aug. 28. A Dyess Air Force Base employee said refrigerators had been restocked and were operating under observation.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Agency documents describe centralized alarm monitoring paired with store-level refrigeration controls. DeCA engineering guidance says refrigeration monitoring and control systems manage defrost cycles, stage compressors and regulate condenser fans. It specifies that electric defrost begins on a timer and ends when a temperature threshold is reached, with a time-based fail-safe.
A 2020 DeCA maintenance task order, with options through June 2025, required a contractor to continuously monitor refrigeration and heating, ventilation and air conditioning alarms from stores in the United States and its territories. The contractor’s master monitoring system was to be located in the continental United States. The records do not indicate whether the affected commissaries shared infrastructure or whether the master system could send commands to stores. No public reporting has identified unauthorized access or other evidence of malicious activity.
The failures occurred about a month after attacks on internet-facing programmable logic controllers at U.S. water and wastewater utilities disrupted monitoring or control at some facilities. DeCA has not said its refrigeration systems use the same controllers or are exposed to the public internet, and no public source has connected the events.
As of Tuesday, officials had not announced a systemwide all-clear, identified a root cause or provided a final count of affected commissaries.
