Attacks on the power grid: what they did to households and how to prepare

At a glance

• Attacks are increasing. NERC reported in April 2023 that physical security incidents causing a measurable outage rose 71% since 2021. E-ISAC received more than 2,800 physical security reports in 2023.
• Most do not cut power. Over 2020 to 2022, 97% of incidents caused no service disruption and 3% had localized customer impact (NERC, citing E-ISAC).
• The worst US case so far was local and lasted days. The December 2022 Moore County, North Carolina attack left about 45,000 customers without power, with full restoration about five days later.
• Cyber threats are on the record. CISA, NSA and FBI warned in February 2024 that state-sponsored actors were pre-positioning inside US critical infrastructure networks, including energy.
• What a household should plan for: a sudden, unannounced outage of several days in winter or summer, with no storm warning to prompt last-minute shopping.

Why attacks matter differently from storms

A hurricane or ice storm comes with days of forecasts. An attack does not. Moore County residents lost power on a Saturday evening with no chance to fill tanks, buy ice or charge batteries. That is the core lesson: the gear and supplies that matter are the ones already in the house.

The Congressional Research Service put the main risk plainly in its 2015 report on substation security: the concern from a physical attack is "a widespread power outage lasting for days or longer." Large transformers are custom equipment with long replacement times, which our solar storm guide covers in detail. So far, most attacks have been absorbed with little or no customer impact.

The record: major US and overseas incidents

Metcalf, 2013: the wake-up call

In April 2013, attackers fired on PG&E's Metcalf substation south of San Jose. A California Public Utilities Commission presentation counts 17 damaged transformers across the 500 kV and 230 kV yards, about 52,000 gallons of spilled oil and roughly 15.4 million dollars in restoration costs. It also records "No outages." CRS noted that "electric service was not interrupted despite the loss of a critical substation." The attack pushed federal regulators to write the first mandatory physical security standard for the bulk grid.

Moore County, 2022: the household case study

On the evening of December 3, 2022, gunfire disabled two Duke Energy substations in Moore County, North Carolina. About 45,000 customers lost power. Duke restored customers in waves of several thousand as repairs finished, and by early Thursday, December 8, its outage map showed no Moore County outages (WUNC). Schools closed through Thursday. FirstHealth Moore Regional Hospital ran on generators until Wednesday morning, and county transport was limited to dialysis, chemotherapy and radiation trips (AP).

ABC11 reported in December 2025 that the case remains unsolved, with a combined reward of up to 100,000 dollars, and that an 87-year-old woman is the only known death related to the outage. NERC later found the attacked substations "would not have been covered" by the federal physical security standard, because that standard targets the largest transmission substations.

The Northwest, 2022, and two federal prosecutions

Oregon and western Washington saw six confirmed substation attacks between mid-November and early December 2022, across four utilities including the Bonneville Power Administration and Portland General Electric (OPB). On Christmas Day 2022, four substations in Pierce County, Washington were damaged and more than 14,000 customers lost power. One defendant in that case was sentenced to 18 months in December 2023; prosecutors said the goal was to cut power so the group could burglarize businesses, and that "their motivation was greed" (U.S. Attorney's release, reposted by the Maryland Coordination and Analysis Center).

In Maryland, two people were convicted in a plot to attack Baltimore-area substations. Sarah Clendaniel was sentenced to 18 years in September 2024, and Brandon Russell to 20 years in August 2025, according to Maryland Coordination and Analysis Center posts citing CBS News and the U.S. Attorney's Office. The plot was stopped before any attack.

The numbers behind the trend

• About 1,700 physical incidents were reported to E-ISAC in 2022, up 10.5% from 2021 (Utility Dive, reporting NERC's April 2023 filing).
• More than 2,800 physical security incidents were shared with E-ISAC in 2023, including ballistic damage, theft and vandalism. About 3% affected the grid (E-ISAC 2023 End-of-Year Report).
• Outage-causing incidents rose 71% since 2021 and 20% since 2020 (NERC, April 2023).
• NERC recommended against a uniform minimum protection set for every substation, calling it "unlikely" to be effective, and said the risk-assessment part of the standard needed revision.

Cyberattacks: documented abroad, warned about at home

The clearest real-world grid cyberattack hit Ukraine on December 23, 2015. CISA's alert describes remote intrusions at three regional distribution companies that cut power to about 225,000 customers. Operators restored service by switching to manual operations, and the outage lasted several hours.

In the US, the February 2024 joint advisory AA24-038A from CISA, NSA and FBI said with high confidence that Chinese state-sponsored actors known as Volt Typhoon were pre-positioning on IT networks to enable disruption of operational systems in a crisis. Energy was one of four main sectors named, along with communications, transportation and water. Some footholds had lasted at least five years. Separately, GAO reported in March 2021 that distribution systems are increasingly at risk and that "the scale of potential impacts from such attacks is not well understood."

A cyberattack that also disrupts water systems or cell networks would stretch a household further than a power loss alone. Plan your water on the assumption that pressure can drop: our water guide covers storage and treatment.

What we don't know

• How a coordinated, multi-site attack would play out. Every US case on record hit one or a few substations. Public reports do not model the household impact of a larger campaign, and we will not guess.
• What Volt Typhoon access could do in practice. The advisory describes access and intent, not a demonstrated US outage.
• Who attacked Moore County, and why. The case is unsolved. Treat any claim otherwise as unconfirmed.
• Full incident counts. E-ISAC figures depend on what utilities choose to share, so the real total may differ.

How to prepare: plan for a sudden multi-day outage

Moore County is the right planning case: no warning, about five days, in cold weather, with schools shut and medical services strained. If your home can handle that, it can handle most storm outages too. Build toward the 30-day plan once the first week is covered.

Readiness checklist: have this before anything happens

1. 01Water for 5 days or more. At least one gallon per person per day (CDC, Ready.gov). For a family of four that is at least 20 gallons.
2. 02Food that needs no refrigeration or cooking for the same period. See the long-term food storage guide.
3. 03Light without candles. One LED lantern per room you use at night, plus headlamps and spare batteries.
4. 04A way to hear official updates. A NOAA weather radio with crank or battery power, because a local outage can also strain cell service.
5. 05Charged power banks for every phone, kept topped up, not stored empty.
6. 06Backup power for medical needs such as CPAP, oxygen concentrators or refrigerated medicine. Moore County's hospital was limited to dialysis and cancer-treatment transport; do not count on rides.
7. 07A cold-weather and hot-weather plan. Know which room you will heat, and which cooling center or relative you would go to. Our heating without power guide covers safe options.
8. 08Cash in small bills, since card readers and ATMs depend on power.
9. 09A written contact plan for family members, including someone outside the area.

No. 1Emergency radio

Midland ER310 Emergency Crank Weather Radio

Best for: A household weather radio with several ways to stay powered

• Power: solar, hand crank, 3,500 mAh rechargeable Li-ion, or 6 AA batteries
• NOAA weather band; alerts sound when issued on your local channel
• LED flashlight with SOS beacon
• USB output to top up a phone

Tradeoffs

• · Midland notes the design dates to the early 2000s and may not charge newer phones (iPhone X and later) reliably. Weather alerts are not SAME county-coded.
• · Midland's FAQ notes solar tops up a charged battery rather than reviving a dead one
• · Micro-USB charging rather than USB-C

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

No. 2Lantern

Lepro 1500lm Battery Powered LED Camping Lantern

Best for: Bright, flame-free room light that runs on stored batteries

• 1,500 lumens, dimmable (manufacturer rating)
• Runs on 3 D alkaline batteries (not included); not rechargeable
• Up to 12 hrs at 1,500 lm (manufacturer figure)
• IPX4 water resistance; daylight, warm, full and flashing red modes

Tradeoff

• · Not rechargeable, so stock spare D cells; lumen and runtime figures are self-reported.

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

No. 3Power bank

Anker 737 Power Bank (PowerCore 24K)

Best for: High-capacity USB-C bank that can charge a laptop

• 24,000 mAh
• 140W max output
• 2× USB-C + 1× USB-A
• Smart digital display
• 630 g (22.22 oz)

Tradeoffs

• · No solar input; recharge from wall or USB-C
• · Heavy for a pocket

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

Backup power, sized to what you actually need

For a five-day outage, most households want to keep a refrigerator, lights, phones and any medical devices running. A portable power station handles that indoors with no exhaust; a generator covers bigger loads but must run outdoors, at least 20 feet from the home. Add up your loads in the backup power calculator on our sister site, and read the generator carbon monoxide safety guide before running any engine.

No. 1Power station

Anker SOLIX C1000 Portable Power Station

Best for: Running a fridge, lights, phones and a CPAP through a one- or two-day outage

• 1,056 Wh capacity (up to 2,112 Wh with the matching expansion battery)
• 1,800 W continuous / 2,400 W surge AC output
• LiFePO4 battery chemistry
• 6 AC outlets
• 28.44 lb

Tradeoff

• · At about 28 lb it is a carry-to-the-car unit, not a grab-and-go bag item.

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

No. 2CO alarm

First Alert CO710 Carbon Monoxide Alarm with 10-Year Battery

Best for: A no-install alarm you can set on a nightstand or carry room to room

• Sealed 10-year lithium battery (no battery changes)
• Listed to UL 2034
• Backlit display: CO level, peak level and temperature
• 85 dB alarm; tabletop design

Tradeoff

• · Tabletop only, and when the sealed battery ends the whole unit is replaced.

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

Talking to neighbors when phones are down

Licensed GMRS handhelds let a household and nearby neighbors coordinate without cell towers. A GMRS license covers immediate family members, and the FCC rule sets no exam. Our ham and GMRS radio guide explains the rules.

GMRS radio

Midland GXT67 PRO 5-Watt GMRS Two-Way Radio

Best for: Household and neighborhood talk with repeater access

• 5 watts; repeater capable with 8 GMRS repeater channels and split tones
• Up to 99 GMRS/FRS channels (22 standard, 28 preset privacy-code, up to 49 user-defined)
• IP67 waterproof and dustproof
• NOAA weather alert; up to 4-day battery life, 4-hour rapid charge (manufacturer)

Tradeoffs

• · Transmitting on GMRS requires an FCC license (47 CFR 95.1705); the manufacturer page does not say so
• · Sealed battery is not user-replaceable

Check price on AmazonRead the full reviewSpecs: manufacturer page, checked Nov 1, 2026

Reporting suspicious activity

Households near substations are part of the security picture. CISA and DOE encourage utilities to reach out to residents living near substations and ask them to report suspicious activity, such as unusual photography or surveillance. DHS guidance is direct: if there is an emergency, call 911; report non-emergency suspicious activity to local law enforcement. Do not approach anyone, and do not enter or touch utility equipment. If you see damaged equipment or downed lines, call 911 and your utility.

Next: print the blackout checklist, build the Blackout Kit, and read how long power outages last for the wider record.