Pentagon Treats Base Freezer Failures as Suspected Hack After Europe’s Industrial Sabotage

The Pentagon is treating clustered freezer malfunctions at U.S. military bases as a suspected cyberattack after at least six commissaries lost refrigerated food in August, Reuters reported Thursday. Investigators have not identified a cause, a perpetrator or a link to the recent French refrigeration attacks.

Reuters found that at Fort Huachuca, Arizona, freezers entered defrost mode and heated the food. Cyber Command said a unit was coordinating with interagency and law-enforcement partners, while the Army Criminal Investigation Division said its Cyber Field Office was involved and working with French authorities. The case remains an investigation, not a confirmed attack.

In Spain, Bloomberg reported that ovens at an Alicante crematorium stopped working, machinery used to manufacture renewable-energy transformers in Catalonia malfunctioned and caused a fire, and two wineries suffered heating and ventilation disruptions. Meduza’s accessible account of the investigation says the same campaign also reached American water, wastewater, meat-processing and manufacturing targets. Those incidents remain one Bloomberg reporting chain rather than separate corroboration.

One attack has a fuller public record. Tureby-Alkestrup Waterworks in Denmark says intruders forced every pump to zero, leaving about 450 households without water for roughly an hour. The pressure was later pushed to 100 percent; a burst pipe left about 50 households without water for roughly seven hours. TV 2 Kosmopol separately interviewed chairman Jan Hansen and reported that three pipes burst within 24 hours.

The route in was brutally ordinary. The Danish waterworks association says remote access exposed the pump controls through VNC and a simple four-digit PIN. The utility restored service, replaced the connection with a secure VPN and added dedicated computers; Kosmopol reported that it also introduced new passwords and multifactor authentication. Repairs, leak detection and new security equipment cost several hundred thousand Danish kroner.

The European Union’s July sanctions record identifies Z-Pentest as a pro-Russia group assembled from members of CARR and NoName057, and records its December 2024 attack on a Danish water utility. The same record links CARR to the GRU’s Main Centre for Special Technologies. That official attribution supports the group relationship and the Danish case; it does not prove that Russian intelligence directed every incident described by Bloomberg.

Meduza’s account says U.S. authorities describe the campaigns as opportunistic and low in technical sophistication, while warning that the groups exaggerate some claims. The strongest independently documented damage in the current record is the Danish waterworks attack; the wider industrial trail is Bloomberg’s investigation. The public record reviewed here supports group relationships and an official attribution, not operational orders from Moscow.