Every system you lean on — power, water, fuel, payments, phones — moved onto software and networks over the last few decades. That bought a lot of efficiency, and it opened a new door: these systems can now be knocked over from a keyboard, by a criminal or a government, with nobody anywhere near the equipment. A cyberattack on infrastructure scores likelihood 5/9 and rising, impact 6/9 — more likely every year as more of the world runs on software, and felt at your house as an outage, not as a threat to your body.
That last part is the whole trick. However exotic the cause, the effect in your kitchen is the power’s out, the card reader’s down, the pump won’t run. That’s not a hacking problem you have to solve; that’s an outage you already know how to prep for — with two additions this threat specifically demands: cash and your data offline.
Why it’s on the list
We rank threats by how likely they are against how much they’d cost you, and this one stands out for a rising likelihood. The reason is structural: as the grid, the water plants, and the banks run on more connected computers, the number of targets and the number of people who can hit them both keep growing. The impact is moderate — not because these systems don’t matter, but because the way you experience the failure is disruption, not danger. A threat that’s climbing in odds and lands as a familiar failure is exactly the kind to prep for efficiently — by reusing the outage kit you should own anyway.
The mechanism — why software dependence is the weak point
Modern infrastructure is run by networked computers, including the industrial control systems (SCADA) that operate grids, pipelines, and water plants. Attackers work a few recurring angles:
- Ransomware. They lock up an operator’s computers and demand payment, which forces a shutdown even when the physical equipment is fine. The May 2021 Colonial Pipeline attack (by the DarkSide group) shut a line carrying nearly half the East Coast’s fuel for about five days and set off panic-buying across the Southeast. The February 2024 Change Healthcare attack snarled billing and prescriptions across much of the US health system for weeks.
- Getting into the control systems directly — the more serious concern — where an attacker reaches the systems that actually work the breakers, pumps, and valves, and can cause outages on purpose.
- Hitting payments — banks, card networks, ATMs — so people can’t transact.
- Tampering with the hardware before it’s installed. The New York Times Magazine reported in August 2026 that China was caught planting backdoor software inside a large power transformer being shipped to a federal utility in Colorado. A compromised part is a foothold no amount of network security at the operator can catch, because the danger arrives inside the machine.
Now the fact that should get your attention: the grid doesn’t have to be attacked everywhere to go down. Its critical points are few. Jon Wellinghoff, a former chairman of the Federal Energy Regulatory Commission, concluded — in a modeled scenario, not a certainty — that taking out as few as nine substations across the three US power interconnections could black out the entire country. That came to public light after the 2013 sniper attack on the Metcalf substation near San Jose, which pushed regulators to write a physical-security standard for the grid’s most critical stations. The lesson for prepping is blunt: whether the weapon is a keyboard or a rifle, an attacker only has to hit a few well-chosen points. A large, sudden outage isn’t a stretch — it’s a realistic thing to plan for.
And it gets worse each year for one reason: everything is wired together. These systems connect to each other and to the internet for efficiency, so one success can spread and a single attack can cascade across sectors. That wiring is both the door the attacker uses and the reason the effects ripple.
Recently, the increase in capabilities of AI has greatly increased the opportunity for attack as well. Where it once required very complex and specialized computer skills to carry out a cyberattack, the use of AI is now bringing this capability to almost everyone with an internet connection. This proliferation of capability will almost surely increase the occurrence of attacks.
What it does — the cascade
Because the sectors depend on each other, a hit on one spreads:
- Power. The grid is the master dependency. Lose it and water pumping, fuel dispensing, payments, refrigeration, heating and cooling, and phones all degrade together. Most serious cyber scenarios run through electricity.
- Payments. If banking or card networks go down, digital payment stops — cards decline, ATMs go dark, and a cashless household suddenly can’t buy anything. This is the distinctive cyber failure the storm-prepper never planned for.
- Fuel. Stations need power and payment to dispense; a pipeline or payment hit produces shortages and panic-buying fast.
- Food and supplies. Stores run on power, payment, and logistics software; disruption thins shelves quickly, and panic empties them quicker.
- Communications. Internet and cell outages create an information vacuum — dangerous because not knowing drives panic and bad decisions more than the outage itself does.
The through-line: none of this is lethal to a prepared household, and all of it is brutal to an unprepared one. Your prep is what turns a crisis into an inconvenience.
Engineering your resilience — the outage kit, plus two
Measure your readiness in days you can run disconnected — not dollars. Four moves.
1. Outage resilience is the foundation. Build or reuse your standard multi-day outage kit, because that’s what a cyberattack feels like at home:
- Water and food for several days to weeks — food that needs no fridge and no cooking, or an off-grid way to cook it.
- Power: flashlights, batteries, power banks, and ideally a generator or a solar-and-battery setup to run the essentials — fridge, medical devices, communications. Even a modest battery bank keeps a phone and a radio alive.
- Heat or cooling without the grid, for the length of the outage.
- Light and hand tools to function without power. The deeper your general outage resilience, the more cyber-proof you already are — for free.
2. Cash — the backup payment system. This is the piece unique to this threat. When the payment network fails, physical cash is the only thing that still works. Keep a reserve of small bills at home — enough to buy fuel, food, and essentials for at least several days, ideally longer. Small bills specifically, because making change may be impossible mid-disruption, and a stack of hundreds is useless if nobody can break them.
3. Your data and documents, offline. A cyberattack — and the ransomware or outage it causes — can lock you out of online accounts and cloud files. Keep offline copies of what matters: IDs, insurance, medical, and financial records in a physical folder, and important digital files on a local drive kept at home. Don’t let a single online account or cloud service be the only copy of anything you’d need in a crisis. When the network’s down, a local copy is the difference between having your records and having nothing.
4. Information and communication. Keep a lifeline that doesn’t need the internet: a battery or hand-crank radio (NOAA/AM/FM) for news and emergency broadcasts, charged devices and power banks, and a simple family plan for when cell service is spotty. Knowing what’s actually happening — and being able to reach your people — is most of staying calm and making good calls when the screens go dark.
Bottom Line
- A cyberattack on infrastructure is a rising, mid-likelihood threat (5/9) that lands as an outage (6/9), not direct danger — a familiar failure with an exotic cause.
- Whatever the cause, prep as for a multi-day utility outage — that foundation covers most of it, and it covers storms too.
- Add the two cyber-specific pieces: cash (the only payment method that survives a network failure) and offline copies of your critical data and documents.
- Power routes everything — the grid is the master dependency, so backup power and off-grid essentials are high-value.
- Keep an internet-independent information lifeline — a radio, charged devices, a family plan — so an information vacuum doesn’t drive you into panic.
You can’t patch the power company’s software. You can be the household that treats a digital blackout exactly like a snowstorm — water in the pantry, cash in the drawer, a radio on the shelf, and no reliance on a screen that just went dark.
The outage foundation starts with food and water — size yours with the Food & Water Storage tool, and keep critical documents offline and organized in the Digital Binder.