The Pentagon is investigating a suspected cyberattack involving refrigeration systems at at least six U.S. military bases, according to Reuters.
The malfunctions occurred in August at military commissaries, where freezer temperatures unexpectedly increased, spoiling food. At Fort Huachuca in Arizona, officials reported that a freezer entered defrost mode overnight, heating its contents rather than maintaining safe storage temperatures.
The investigation follows a confirmed cyberattack on commercial refrigeration systems at more than 350 establishments in France earlier this month.
Damon Small, Board Member, Xcape, Inc.
“Compromising industrial refrigeration systems transforms routine facility hardware into an immediate operational liability, spoiling vital food supplies and disrupting logistics across military bases. While refrigeration devices may seem an unlikely target, the reality of the situation is that attackers are often opportunistic. The question we have to ask is whether these and other incidents against industrial cooling units are targeted to cause panic and damage, or if it is simply a matter of adversaries finding a new attack path. With similar attacks recently targeting healthcare organizations, this trend is having a chilling effect (pun intended) on operational technology security. Aside from the weak authentication and identification mechanisms featured in these industrial units, the fact that they are accessible from the Internet remains the primary concern. In short, if the question is who would want to attack a freezer, the answer, apparently, is lots of people.”
“Critical Takeaways:
- Opportunistic exposure over advanced capability: Industrial control systems frequently suffer from weak authentication and legacy identity mechanisms, making any unit reachable from the public Internet an easy mark for threat actors.
- Cascading operational disruption: Whether spoiling commissary provisions across defense installations or compromising temperature-sensitive pharmaceuticals in healthcare facilities, cooling failures yield immediate physical consequences.
- Mandatory perimeter isolation: Security teams must immediately audit facilities networks to remove refrigeration controllers from direct Internet exposure, isolate operational technology on dedicated segments, and enforce strict access controls.
“Attackers may not care about commissary breakfast menus, but they will happily exploit any exposed thermostat that responds to default credentials.
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“The pattern here is getting hard to miss at this point. Nichirei Logistics in Japan this summer, 700 French supermarkets through Danfoss controllers earlier this month, and now suspected activity at six U.S. military commissaries, with one freezer entering defrost mode overnight exactly like the attack in France.
“The question for investigators is whether this is the same actor working through different sectors, whether the technique has spread far enough that multiple groups are picking it up independently, or just a coincidence.
“This pattern impacting military bases takes the concern to another level. Spoiled food sounds minor, but the same access that defrosts a freezer could do a lot worse at a military base that runs on cold storage for medical supplies, blood, or really anything else relying on temperature control. Any operator still running internet-reachable refrigeration controllers at this point should get ahead by finding every reachable controller in their environment this week and either disconnecting them from the public internet or putting them behind a VPN.”
ㅤ
Steven Swift, Managing Director, Suzu Labs
“We probably won’t, and shouldn’t get additional detail regarding the potential to freezer tampering as a cybersecurity attack. Reports thus far are that freezer temperatures were unexpectedly set to defrost, and that it was a “potential cyberattack”
“In a similar 2022 attack against supermarkets, they had been using obsolete versions of cold storage controllers. IOT devices such as these are famously insecure, out of date devices even more so. There’s just not enough incentive for manufacturers to invest much into security, no one is making purchasing decisions based on how secure they think their refrigerator is.
“Many of these devices were never intended to be connected to the public internet. It matters a lot less if a device is insecure, if its only accessible locally. It’s just a much smaller attack surface. However, lots of these devices are getting connected to the internet, which suddenly makes those vulnerabilities matter.
“We don’t have any way to know if this was actually a cyberattack. Its pretty easy to blame issues on “the hackers must have done it” for what could have also been either human error, or a glitch in the system. Especially so for infrastructure which is typically insecure.”
ㅤ
Jermaine Logan, Staff Product Security Engineer, Finite State
“If these turn out to be cyberattacks, the lesson isn’t that freezers are fragile. It’s that the software inside everyday equipment is rarely something the buyer can actually see. Our own work showed how much is sitting in a refrigeration controller’s firmware. Buyers with serious stakes, the DoD included, should be demanding that visibility from device makers before deployment, not reconstructing it after the food spoils.”
Freezers are to be considered critical infrastructure. So you should take the same precautions that you do take with critical infrastructure. You do take precautions with critical infrastructure, do you?
Florida DOE data breach potentially exposes SSNs of 4.9 million people
Posted in Commentary with tags Florida on November 1, 2026 by itnerdThe Florida Department of Education (FLDOE) has disclosed a cybersecurity breach potentially affecting approximately 4.9 million people.
The incident involved unauthorized access to the state’s Florida Student Financial Aid website, exposing personally identifiable information, including Social Security numbers. Department staff discovered the breach on October 19.
Officials believe the breach was limited to the financial aid website but warned that certain online services may experience temporary disruptions during recovery.
The https://www.floridastudentfinancialaidsg.org/ website read: “This site is currently under maintenance and will be available soon. We apologize for the inconvenience.”
The department confirmed that existing financial aid, tuition payments and eligibility for scholarships, grants and student loans will not be affected.
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“I never get used to hearing about incidents like this. It seems we barely finish discussing one breach before another reminds us how much sensitive information people are required to entrust to the systems they depend on.
“Florida estimates that approximately 4.9 million people may be affected. That number is preliminary, but even as an estimate, it’s substantial. From a security perspective, you prepare for the potential scope while allowing the investigation to establish what happened. The department has not publicly identified the intrusion method, so it’s important not to speculate about how the attackers gained access or which controls may have failed.
“What concerns me is the information potentially involved and what could happen to it afterward. Social Security numbers, dates of birth, addresses, and other personal identifiers can be combined with information from other sources to facilitate identity theft, synthetic identity fraud, or highly targeted social engineering. Those are potential downstream risks, not confirmed consequences of this incident. Unfortunately, personal information doesn’t come with an expiration date simply because a breach investigation has concluded.
“Having spent decades building, defending, and testing systems, I believe we must look beyond restoring operations and ask whether we’re adequately protecting the trust people place in these services. That means minimizing unnecessary sensitive data, limiting access, and continuously validating whether security controls work.
“It’s reassuring that officials say financial aid and eligibility will not be affected. But the larger issue is that people often have little practical choice about providing sensitive information to obtain essential services. They shouldn’t have to become cybersecurity experts to protect themselves afterward.
“An organization may recover its systems in weeks, but the people whose information was exposed could be dealing with the consequences for years. That’s the part of these incidents we cannot afford to normalize.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“Student financial aid systems hold three high-value data categories. Identity information, financial records, and household income data are all on the table here.
“For other state education departments, this is the time to confirm whether anyone has pentested these portals the way an attacker would, and if not, kick that off now so they can patch the exploitable vulnerabilities before someone else finds them. Public sector web applications accumulate technical debt faster than they get security review, and the ones holding Social Security numbers deserve a different level of scrutiny.”
ㅤ
John Strand, Owner, Black Hills Information Security
“These types of breaches are heartbreaking to me. Usually, the organization shuts the site down for a while and offers credit monitoring to the victims. But people may not understand the full extent of the damage until much later, when their personally identifiable information is used to open fraudulent accounts in their name.
“The impact doesn’t necessarily show up right away. For some victims, the identity theft and financial damage could surface years down the line.”
ㅤBreaches are very bad. And this one will be no different for those who are affected. Organizations need to keep that in mind as these breaches affect more than just the organization in question.
Leave a comment »