DeCA Acknowledges Refrigeration Disruptions at Six Commissaries August 26-27
Multiple DeCA commissaries lost refrigeration capacity on consecutive days. Official statements confirm equipment behavior but provide no root cause. Patterns align with known OT exposure rather than confirmed intrusion.
Fort Huachuca, F.E. Warren AFB, Fort Irwin, Columbus AFB, Naval Station Newport and Travis AFB recorded confirmed outages. Official base accounts stated equipment entered defrost mode without power loss. The Substack compilation listed 14 initial reports; five were later struck after local verification showed normal operation or prior unrelated notices.
No CVE or incident report attributes the events to remote access. Commercial refrigeration units at DeCA facilities run on legacy controllers with documented network exposure in 2023 DoD IG audits. Simultaneous timing matches patterns seen in 2024 OT incidents at civilian cold-chain operators where default credentials allowed command injection.
Operational impact includes total loss of frozen inventory at affected sites and temporary sourcing from civilian suppliers. DeCA has not published controller firmware versions or segmentation status. Continued monitoring of additional bases through September will determine whether failures cluster around specific equipment models or procurement batches.
CISA: No public attribution or patch advisory issued within 45 days
Sources (3)
- [1]Signal and Silence Substack(https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary)
- [2]Department of Defense IG Audit 2023(https://www.dodig.mil/reports)
- [3]Stars and Stripes Coverage(https://www.stripes.com)