“ALL freezers went into defrost mode.”
Fort Huachuca, Arizona, describing an overnight failure at its commissary, August 2026
That notice went up on an Army post’s Facebook page in late August. The rest of it read, “ALL frozen food has spoiled.”
Seven weeks later, hackers did it on purpose to hundreds of supermarkets in France.
The French attack is being covered as a French story, with the American outage as a line near the bottom. Start in Arizona and the story changes. A way into this brand of freezer controller was public. The fix was public. The US government had warned about the equipment by name in May 2025. And the Defense Department has not said what happened to its own freezers.
Overnight from Sunday into Monday, refrigeration controllers in French grocery stores were told to defrost. Fridges and freezers climbed as high as 122 degrees Fahrenheit and stayed there for six hours.
Carrefour counted 80 stores. Coopérative U, Intermarché, Monoprix and E.Leclerc were hit as well. Fires broke out at several sites, and affected branches had to throw away everything fresh and frozen.
Dominique Schelcher, who runs Coopérative U, put a store’s loss at tens of thousands of euros for a small shop and up to 200,000 euros for a hypermarket. Intermarché’s chief executive, Thierry Cotillard, put the national bill at “tens of millions of euros nationwide in a single day.”
Paris prosecutors have opened an investigation. Nobody has been publicly identified.
The intruders were patient about one thing. In some freezers they stretched the defrost cycle from one hour to eight, which pushed the alarms back until the food was already gone.
Nothing in those stores was broken.
Every commercial freezer defrosts itself on a schedule, because ice on the coils is how a freezer stops being one. The attackers triggered a forced defrost from far away and let it run.
The machines did what machines of that type do. They did it at the request of someone who was not supposed to be asking.
The alarm delay worked the same way. Nobody cut a wire. The length of a defrost cycle is a setting, and settings are what a logged-in manager is allowed to change.
So the weak point was an assumption. The control panel assumes that whoever is logged in works for the store.
On Aug. 9, researchers at the security firm Claroty published a study of one Danfoss controller, the AK-SM 800A. They titled it “Freeze the Controller, Defrost the Food.” Subtlety was not the goal.
They found a hidden login. The device would accept a “code of the day” generated from its own calendar date, a back door that looks like it was left for support technicians. Anyone who worked out the formula could walk in as an administrator.
They also counted. A scan turned up 2,765 of the management panels reachable from the open internet.
None of that was news to Washington. The Cybersecurity and Infrastructure Security Agency first published its advisory on the same controller family on May 20, 2025, and Danfoss had patched firmware out.
Investigators have not said how the attackers in France got in, so the Claroty flaw is a suspect and nothing more. Danfoss says the affected systems “were running outdated firmware.” It told Agence France-Presse that most were older products that no longer get security updates at all.
Its advice for those is to “migrate legacy systems to current-generation solutions.” That is the long way of saying buy a new one.
So a freezer case can outlive the software that runs it. The store keeps the compressor. The vendor retires the code.
After the attack, a researcher counted 2,752 Danfoss panels still exposed online, 1,590 of them in France. The other 1,162 are somewhere else. Scans have placed some in the United States.
Which returns us to the commissaries.
On Aug. 26 and 27, refrigeration failed at military grocery stores across the country. Military Times confirmed seven, from Fort Irwin in California to Naval Station Newport in Rhode Island. A widely followed military social media page counted at least 18.
Newport sold dry goods only. Fort Irwin stopped selling eggs and milk, then everything cold.
That was 17 days after Claroty published the details.
Seventeen days proves nothing. It is still a number an investigator writes down.
The Pentagon’s statement at the time: “The Department is aware of a possible refrigeration disruption at some Defense Commissary Agency commissaries.” A defense official added that it would be “inappropriate to speculate as to the cause.”
Military investigators opened inquiries. No finding has been made public.
Nobody in government has said which controllers the commissaries run. The tech site Gigazine reported that a searchable copy of the commissary agency’s equipment list shows a Danfoss AK-SM unit at Naval Air Facility El Centro in California. We have not confirmed that list, and no official has.
Look at who got hit in France and a pattern shows up.
Carrefour, a corporate chain, reported 80 of roughly 6,000 stores. Coopérative U reported 80 of 2,000 by one count and more than 100 by another. Intermarché’s number runs from 150 to 300 depending on who is counting.
Coopérative U and Intermarché are groups of independent store owners. Our read: when each owner buys the remote panel, each owner also owns the update, and some of them never get to it.
The convenience is real. One technician can watch a hundred stores from a laptop.
The attack is that same sentence with a different technician.
And the cost lands on whoever is holding the food. In France this week, that meant store owners filling dumpsters. In August, it meant military families at a base store with nothing cold to sell.
One American grocery owner is already near the frame, possibly by coincidence. Ahold Delhaize, the Dutch parent of Stop & Shop, Giant, Hannaford and Food Lion, reported a separate “security issue” on Monday and says it sees no reason to link it to France.
We think the Pentagon’s August answer has expired.
“Inappropriate to speculate” is a fair thing to say on day two. This is day 47, and the same failure has now started fires in supermarkets in an allied country.
Military families are owed three plain facts: whether it was an intrusion, which controllers were involved, and whether they have been patched or replaced.
The civilian side is owed something too. CISA wrote the warning in 2025. It should say now whether American grocers have these panels facing the open internet, and tell them to take the panels off it.
France’s own government called exposing them that way “contrary to best practices,” which is a polite phrase for leaving 1,590 control panels out on the street.
The fix for a known flaw is a firmware update and a firewall rule. The fix for an unsupported controller is a purchase order, and those tend to get signed the morning after the meat thaws.
France has asked its European neighbors to check their stores. The United States had a seven-week head start on the same question and has not used it.