Could a Cyberattack Take Down the U.S. Power Grid?

Cyberattacks on power grids are no longer hypothetical. Ukraine has lost power to them twice, Poland fended one off at the end of 2025, and U.S. security agencies say state-backed hackers have spent years hiding inside American infrastructure networks. But the distance between "hackers got in" and "the lights went out across America" is large. This guide covers what has actually happened, how the U.S. grid is built and defended, and what a realistic worst case looks like.

Key facts

• On December 23, 2015, attacks on three Ukrainian distribution companies, carried out within 30 minutes of each other, caused outages for about 225,000 customers (CISA).
• On December 17, 2016, the Industroyer (CrashOverride) malware cut power to part of Kyiv for about an hour (ESET).
• On December 29–30, 2025, attackers hit Polish energy sites. Prime Minister Donald Tusk said the attacks could not have caused a blackout, and ESET attributed them to Russia's Sandworm group with medium confidence.
• In February 2024, CISA, NSA and FBI said China's Volt Typhoon had kept access to some victims' networks for at least five years, including in the energy sector (CISA).
• GAO reported in 2019 that cyber incidents had reportedly not caused power outages in the U.S. (GAO).
• FERC approved mandatory NERC CIP cybersecurity standards for the bulk power system in 2008. They generally do not reach local distribution systems.

What has actually happened

Ukraine, December 2015

According to CISA's alert, outside attackers used remote access to three regional distribution companies' control systems and remotely operated breakers, leaving about 225,000 customers without power. The attacks were synchronized. The intruders also wiped computers with KillDisk malware and corrupted the firmware of serial-to-Ethernet devices at substations, which CISA assessed as an attempt to interfere with restoration. Power came back, but the companies continued to run under "constrained operations" afterward.

Ukraine, December 2016: Industroyer

Just before midnight on December 17, 2016, attackers used Industroyer at the Pivnichna transmission substation outside Kyiv, causing outages that lasted more than an hour, according to an Idaho National Laboratory analysis. ESET found the malware could directly control substation switches and circuit breakers through industrial protocols such as IEC 104 and IEC 61850.

CISA said there was no evidence the malware had affected U.S. infrastructure and that its protocols are more commonly used outside the United States. It also warned that the same techniques could be adapted to U.S. systems (CISA).

Ukraine, April 2022: Industroyer2

ESET and Ukraine's CERT-UA found a new variant, Industroyer2, scheduled to run on April 8, 2022 against high-voltage substations of a Ukrainian energy company. ESET attributed it to Sandworm with high confidence, and said in a later report that the attack was thwarted.

Poland, December 2025: an attack that failed

On January 13, 2026, Poland's energy minister Miłosz Motyka called it "the strongest attack on the energy infrastructure in years," and said it aimed to disrupt communication between renewable energy installations and distribution operators. It failed (Reuters via The Star). Two days later, Tusk said the attacks on two combined heat and power plants and renewable-energy management systems were not capable of destabilizing the system or causing a blackout, and that transmission networks were never threatened (Polish Radio).

ESET named the data-wiping malware DynoWiper, attributed the attack to Sandworm with medium confidence, and said it was "not aware of any successful disruption" (ESET).

Date	Target	Outcome
Dec 23, 2015	Three Ukrainian distribution companies	About 225,000 customers lost power
Dec 17, 2016	Pivnichna substation near Kyiv	Outage of more than an hour
Apr 8, 2022 (planned)	Ukrainian high-voltage substations	Thwarted
Dec 29–30, 2025	Polish heat-and-power plants, renewable systems	No blackout

Volt Typhoon: why U.S. agencies are worried

The most serious U.S. warning came on February 7, 2024. In advisory AA24-038A, CISA, NSA and FBI, joined by DOE, EPA, TSA and allied agencies, said with high confidence that Volt Typhoon was pre-positioning on IT networks so it could move into operational technology and disrupt it. Victims were mainly in the communications, energy, transportation, and water sectors, across the continental U.S. and its territories, including Guam.

Three details matter:

• Duration. Some footholds had lasted at least five years.
• Stealth. The group relies on "living off the land" techniques, using built-in tools instead of obvious malware, and has used end-of-life Cisco and NETGEAR small-office routers to hide its traffic.
• Intent. The agencies said the behavior was not consistent with ordinary espionage and could support disruptive attacks "in the event of a major crisis or conflict with the United States."

Access is not the same as an attack. The advisory describes preparation, not an outage. But it explains why officials treat grid cybersecurity as a national security issue.

Has a cyberattack ever caused a U.S. blackout?

Publicly, no. GAO said in 2019 that cyber incidents had reportedly not caused U.S. power outages. It also cautioned that the scale of outages a cyberattack could cause is uncertain, partly because DOE's risk assessment used a model covering only part of the grid.

The best-documented U.S. disruption is modest. In a lesson learned published September 4, 2019, NERC described an attacker exploiting a known firewall vulnerability to reboot devices at a low-impact control center and several remote generation sites. Communications dropped for less than five minutes at a time over a 10-hour period, and there was no impact to generation. A firmware patch that already existed fixed it.

Why a single "nationwide" takedown is very hard

There is no single U.S. grid to switch off. According to the EIA, the lower 48 states run on three interconnections that "operate largely independently from each other with limited transfers of power between them":

• Eastern Interconnection: east of the Rockies, with 36 balancing authorities in EIA's 2016 count.
• Western Interconnection: the Rockies westward, with 37 balancing authorities.
• ERCOT: most of Texas, run as a single balancing authority.

To black out the country, an attacker would have to compromise many separately owned and operated control systems, often built from different equipment and run by different staff, and trigger them at the same moment without being detected. Even the December 2015 attack in Ukraine, which ESET attributes to Sandworm, reached three companies and about 225,000 customers.

Restoration also works in defenders' favor. In Ukraine, power returned within hours even though the attackers had tried to sabotage restoration.

What a realistic worst case looks like

Based on the incidents above, a sober worst case is regional, not national. It might look like a coordinated attack on several utilities in one area, timed to a heat wave or winter storm when the grid is already stressed, combined with wiped computers or corrupted firmware that forces crews to restore power manually. That could mean outages lasting hours to several days for a metro area or a few states.

One area of concern is the distribution system, the local poles, lines and substations that deliver power to homes. GAO found in 2021 that distribution systems are increasingly at risk because their control systems allow more remote access, that the scale of potential impacts "is not well understood," and that distribution utilities are generally not subject to mandatory federal cybersecurity standards.

For perspective, weather remains the dominant cause of outages. U.S. customers averaged about 11 hours without power in 2024, and major events such as Hurricanes Beryl, Helene and Milton accounted for 80% of that time (EIA).

Who defends the grid

NERC CIP standards and FERC

Under section 215 of the Federal Power Act, NERC develops and enforces reliability standards, subject to FERC approval and oversight. FERC approved the first Critical Infrastructure Protection (CIP) standards in Order No. 706 on January 18, 2008. FERC staff testified in 2011 that section 215 excludes local distribution facilities (FERC testimony). The standards keep evolving: in Order No. 907, issued June 26, 2025, FERC approved CIP-015-1, which requires internal network security monitoring, and directed NERC to extend it further.

DOE's CESER office

DOE's Office of Cybersecurity, Energy Security, and Emergency Response leads the department's role as the Sector Risk Management Agency for energy. Its programs include the Energy Threat Analysis Center, the Cybersecurity Capability Maturity Model (C2M2) and CyTRICS testing of industrial control system components.

The E-ISAC and GridEx

NERC's Electricity Information Sharing and Analysis Center (E-ISAC) shares threat information with utilities and runs GridEx, a biennial security exercise. GridEx VIII, held November 18–20, 2025, drew 378 registered organizations, the most since 2019, and an estimated 28,000-plus players, an all-time high (NERC).

A note on contested claims: Venezuela, January 2026

During the January 3, 2026 U.S. operation to capture Nicolás Maduro, parts of Caracas lost power. President Trump referred to "a certain expertise," and Gen. Dan Caine said Cyber Command and Space Command provided "layering" effects. A New York Times report citing anonymous sources said a cyberattack caused the blackout.

This remains unconfirmed. As of CyberScoop's February 19, 2026 review, the Pentagon and Cyber Command had not publicly confirmed that a cyberattack caused the outage. Photos showed physical damage at several substations, and grid and security experts said that damage alone could explain the outages. Whatever happened, a military operation against an already fragile grid tells us little about the U.S. system.

What households can do

You cannot defend a substation, but you can make an outage of any cause easier to ride out:

• Cover the basics. Ready.gov recommends water, nonperishable food, a flashlight per person, power banks, and battery-backed carbon monoxide detectors. Our grid-down preparedness checklist walks through it.
• Plan for medical needs. Ask your doctor about powered devices and refrigerated medicines.
• Patch your router. Update its firmware, and replace models that no longer receive security updates. Volt Typhoon used exactly that kind of device.
• Rely on verified information. Outages from storms or equipment failure are far more common than cyberattacks. Check your utility, our live outage map and the cyber section of our Grid Threat Monitor before drawing conclusions.
• Know what to do when it happens. See what to do during a power outage.

Cyber is one of several threats we track. For the others, see our guides on physical attacks on the grid and solar storms.

The bottom line

A cyberattack that blacks out the entire United States is very unlikely, because the grid is split into three largely independent interconnections and many separately run systems. A regional outage lasting hours to days is a credible risk, and agencies' warnings about Volt Typhoon show why. Utilities, NERC, FERC and DOE are investing in defenses, and the best household response is the same as for any long outage: be prepared and stay calm.

PowerOutageTracker.com. "Could a Cyberattack Take Down the U.S. Power Grid?." Accessed November 2, 2026. https://poweroutagetracker.com/guides/could-a-cyberattack-take-down-the-power-grid