Physical Attacks on the Power Grid: Substations, Sabotage and Security

Substations are the grid's most visible pressure points: fenced yards of transformers and switches, often in remote places, that step power up for long-distance transmission and back down for local delivery. Since 2013, some of them have been shot at, vandalized and targeted in plots. These attacks are serious crimes and a real security problem. They are also, so far, a small cause of outages compared with weather. Here is what has happened and how the industry is responding.

Key facts

• On April 16, 2013, attackers fired more than 100 rifle rounds at PG&E's Metcalf substation near San Jose, knocking out 17 transformers, with no major power disruptions (VOA).
• On December 3, 2022, gunfire at two Duke Energy substations in Moore County, North Carolina cut power to about 45,000 customers for up to five days. As of December 2025, the case was unsolved (ABC11).
• NERC reported that physical security incidents causing at least one customer outage rose 71% from 2021 to 2022.
• More than 2,800 physical security incidents were shared with the E-ISAC in 2023, and about 3% affected the grid (E-ISAC).
• In February 2023, federal authorities arrested two people for plotting to shoot up five Baltimore-area substations; both were later sentenced to long federal prison terms.
• Large power transformers weigh 150 to 400 tons, and DOE says 36-month lead times are commonly quoted (DOE).

Timeline of major attacks and responses

Date	Event	Outcome
Apr 16, 2013	Rifle attack on PG&E Metcalf substation, California	17 transformers knocked out; power rerouted; 27 days of repairs
Nov 20, 2014	FERC approves CIP-014 physical security standard	Mandatory protections for critical substations
Dec 3, 2022	Gunfire at two Duke Energy substations, Moore County, N.C.	About 45,000 customers out for up to five days
Dec 15, 2022	FERC orders NERC to review CIP-014	NERC report filed April 14, 2023
Feb 2023	Baltimore-area substation plot disrupted	Two arrested before any attack
Feb 3, 2025	Plot leader Brandon Russell convicted	Sentenced to 20 years in August 2025

Metcalf, 2013: the wake-up call

On April 16, 2013, attackers cut fiber-optic cables in an underground vault, then fired more than 100 rounds from at least two high-powered rifles at PG&E's Metcalf transmission substation near San Jose. They knocked out 17 large transformers. Grid officials rerouted electricity, avoiding major outages, but repairs took 27 days (VOA). Former FERC chairman Jon Wellinghoff, as quoted by the Wall Street Journal, called it "the most significant incident of domestic terrorism involving the grid that has ever occurred" in the U.S.

Less than a year later, on March 7, 2014, FERC ordered NERC to write mandatory physical security standards for critical substations (NERC).

Moore County, 2022: when an attack did cause a major outage

On the evening of Saturday, December 3, 2022, gunfire damaged Duke Energy's Carthage and West End substations in Moore County, North Carolina. About 45,000 customers lost power (WFAE). Schools closed, and local officials declared a state of emergency with an overnight curfew (The Independent via Yahoo). Governor Roy Cooper said, "This kind of attack raises a new level of threat."

Some equipment was beyond repair, so Duke had to replace heavy components before reconnecting customers. It finished repairs on December 7 and restored power in waves of several thousand customers at a time; its outage map showed no outages in the county by early December 8 (WFAE via WUNC). The outage came during a cold snap (Transformer Magazine), and local reporting linked one death to it.

Three years later, no one had been identified as responsible. The sheriff called the investigation "active and deliberate," and a combined reward of up to $100,000 remained on offer (ABC11).

NERC's analysis found that the attack rendered one bulk-system substation inoperable but did not cause instability or cascading failures. It also found that the attacked substations would not have been covered by the CIP-014 standard, a gap discussed below.

The 2022–2023 rise in reported incidents

In its April 14, 2023 report to FERC, NERC cited E-ISAC analysis showing:

• Physical security incidents that caused a measurable outage, meaning at least one customer lost power, rose 71% from 2021 to 2022 and 20% from 2020.
• The increase was driven by ballistic damage, intrusion and tampering, and vandalism.
• Of all incidents shared with the E-ISAC from 2020 through 2022, 97% caused no disruption to electric service, and 3% had localized impacts.
• None of the reviewed events caused outages that harmed the reliable operation of the bulk power system.

Threat levels stayed elevated in 2023, when more than 2,800 incidents were shared with the E-ISAC and about 3% affected the grid (E-ISAC). NERC cautions that most reporting is voluntary, so motives and suspects are often unknown.

The Baltimore plot

In February 2023, federal authorities arrested Sarah Beth Clendaniel of Maryland and Brandon Russell of Florida, the founder of a neo-Nazi group, before any attack took place (NBC News). A federal grand jury indicted them on a conspiracy charge on February 14, 2023. According to an FBI affidavit, they planned to shoot up five Baltimore Gas and Electric substations, including ones near Norrisville, Reisterstown and Perry Hall, to cause a "cascading failure" (WTOP).

Prosecutors described a racially motivated plot against a majority-Black city and estimated the damage could have reached about $75 million. Clendaniel pleaded guilty and was sentenced in September 2024 to 18 years (ABC News via ABC7). A jury convicted Russell of conspiracy to damage an energy facility on February 3, 2025, and in August 2025 he received the maximum 20-year sentence (AP via Insurance Journal). The case relied on a confidential informant whom Russell had contacted on Telegram and introduced to Clendaniel.

How substations are protected: CIP-014

FERC approved Reliability Standard CIP-014-1 in Order No. 802 on November 20, 2014. Following FERC's 2014 directive, it requires transmission owners and operators to:

1. Run a risk assessment to identify substations whose loss could cause instability, uncontrolled separation or cascading outages.
2. Evaluate the physical threats and vulnerabilities at those sites.
3. Develop and carry out a security plan for each.

The standard covers transmission facilities at 500 kV and above and certain 200–499 kV substations that meet a weighting test, along with a few other categories. NERC estimates that is around 10 percent of substations in its planning models.

After Moore County, FERC ordered NERC on December 15, 2022 to study whether the standard was adequate. NERC concluded that the applicability criteria were meeting their objective, but that the risk assessment requirement needed clearer language because utilities were performing it inconsistently. NERC said it would start a standards project to clarify the risk assessment. It also found that a uniform minimum set of protections for all substations was unlikely to be effective, and recommended a broader look at reliability, resilience and security measures.

Why large power transformers are hard to replace

Among the hardest equipment to replace after an attack is the large power transformer (LPT), which DOE defines as 100 MVA or larger. In its July 2024 report to Congress, DOE said:

• About 90% of electricity consumed in the U.S. passes through at least one LPT.
• LPTs typically weigh 150 to 400 tons, which makes moving them a logistical challenge.
• Lead times of 36 months are commonly quoted, with some reaching 60 months.
• In 2019, about 82% of new LPTs for domestic use were imported.
• The average installed LPT is about 40 years old.

To shorten recovery, utilities share spares. The Edison Electric Institute's Spare Transformer Equipment Program, started in 2006, has more than 50 member companies, but DOE notes it requires a presidentially declared terrorist attack or emergency to trigger and has never been used. Because most of the transmission system is networked, power can often be rerouted around a damaged substation, as happened at Metcalf.

Attacks vs. weather: keeping perspective

Physical attacks deserve attention, but weather causes far more outages. U.S. customers averaged about 11 hours without power in 2024, and major events accounted for 80% of that time. Hurricane Helene alone cut power to 5.9 million customers across 10 states, Milton to 3.4 million in Florida and Beryl to 2.6 million in Texas (EIA). By comparison, the Moore County attack affected about 45,000.

For long-term trends, see our report on U.S. power grid reliability trends, and check current storm risks on the weather section of our Grid Threat Monitor.

What you can do

• Report suspicious activity. If you see someone tampering with, trespassing at or shooting near electrical equipment, call 911. After Moore County, the FBI asked the public for tips.
• Never enter a substation. The equipment is energized and dangerous even when it looks quiet.
• Prepare for a multi-day outage. Moore County lasted up to five days in cold weather. Plan for heat, water, food and medical devices with our grid-down preparedness checklist.
• Know the first steps. See what to do during a power outage and check our live outage map for conditions near you.

Physical attacks are one of several grid threats. For another, see could a cyberattack take down the U.S. power grid?

The bottom line

Physical attacks on substations increased in 2022 and remain a real concern, as Moore County showed. But the documented record shows local outages, not regional collapse, and none of the incidents NERC reviewed harmed the reliable operation of the bulk power system. Mandatory CIP-014 protections cover the most critical substations, NERC has committed to clarifying how those risks are assessed, and long transformer lead times remain a major recovery challenge. For households, the practical response is the same as for storms: be ready for a few days without power.

PowerOutageTracker.com. "Physical Attacks on the Power Grid: Substations, Sabotage and Security." Accessed November 2, 2026. https://poweroutagetracker.com/guides/physical-attacks-on-the-power-grid