Pentagon probes suspected cyberattack behind freezer outages at US bases

En bref

• Pentagon is examining freezer breakdowns at multiple US military sites.
• Food spoilage followed the cooling outages, according to Reuters.
• US officials suspect a cyberattack; French investigators are assisting.
• No specific vulnerability or confirmed attacker has been disclosed.

The Pentagon is looking into a set of cooling-system breakdowns at more than one US military installation after stored food was lost, Reuters reported, citing US officials. The inquiry is examining whether a cyber intrusion played a role, and the review is connected to outages reported in August.

Because the failures affected freezers used for food storage, the immediate consequence was spoilage rather than a confirmed breach of operational systems. Even so, the case is being watched closely because cold-storage equipment is often part of the broader operational technology estate that supports day-to-day base services.

The Pentagon is coordinating with French investigators, according to the available facts, giving the probe an international dimension. No specific vulnerability, CVE, or confirmed attacker has been identified in the information released so far.

Why it matters: a suspected cyberattack against mundane equipment can still disrupt readiness and supply chains if it causes outages at multiple sites. The incident also highlights the need to treat facility controllers, remote monitoring tools, and vendor access paths as security-relevant assets, not just maintenance equipment.

What to watch: whether investigators find a common technical cause across the bases, how many installations are ultimately affected, and whether the freezer failures were isolated to cooling systems or connected to wider network activity. Updates from the Pentagon and Reuters should clarify scope and attribution.

À faire maintenant

1. Inventory all network-connected freezer, cooling, and remote-monitoring controllers across facilities; record owners, firmware versions, and external access paths.
2. Segment cold-storage and other OT devices onto dedicated VLANs with firewall rules that block inbound internet access and limit lateral movement.
3. Replace default credentials, enforce unique passwords and MFA for vendor access, disable unused services, and apply supported security updates.
4. Enable logging and alerting for controller logins, configuration changes, and unexpected temperature or outage events; forward logs to a monitored SIEM.
5. Prepare manual failover procedures: temperature monitoring, backup power, spare controllers, and a spoilage-prevention call tree.
6. Preserve logs and device images for any suspected OT incident, and report it through incident-response and relevant authorities.
7. Review third-party and vendor remote-access agreements; require prompt notification of security incidents and restrict connections to approved jump hosts.

Source originale

Security Affairs