The most useful way to think about state cyber warfare is this: it doesn’t attack you — it attacks the systems standing between you and the things you need. The grid between you and heat. The banking network between you and groceries. The phone and internet lines between you and your family. Because the attack hits those systems and not your house, the thing that finally reaches you always has the same shape — a service that stops working. And that means you can prepare for it completely without knowing the first thing about the code that caused it.
State cyber warfare is one nation using computer attacks against another’s critical systems as a tool of conflict. It rates impact 6 of 9 — moderate, because it mostly shuts things off rather than knocking them down — and likelihood 4 of 9, mid-scale and rising as these attacks become a normal part of how states fight. Increasingly likely, only moderately damaging, and answerable with the same outage prep you should own anyway: that’s a threat with an excellent return on effort.
Why “moderate impact” is the honest call
It’s worth being precise about why this scores lower than many threats, because the reasoning shapes the prep. A cyberattack mostly disables rather than destroys. It trips a substation, freezes a payment network, corrupts some data, or floods the phone lines — and in most cases those things come back. Operators isolate the attack, switch to backups, and rebuild, usually over hours to days. I see where many preppers consider this to be a near-equivalent of an EMP. Under most instances, it’s just not nearly that severe.
But there’s a harder version, and it’s exactly what a state adversary would aim for: an attack that physically wrecks something slow to replace. The giant transformers at the heart of the grid are the case that matters. A large power transformer weighs around 800,000 pounds, and only about 20 percent are built in the United States — the rest are imported on multi-year lead times. Jon Wellinghoff, a former chairman of the Federal Energy Regulatory Commission, warned that if the right transformers were destroyed, the grid could stay down 18 months or longer. That’s a modeled worst case, not a certainty — but it’s why the grid is a tempting target for a state: a few well-chosen physical hits buy a recovery measured in months to years, not the hours-to-days of an ordinary cyber outage. So the plan is simple to state: prepare for a disruption of days, with an eye on the tail where it runs much longer.
Furthermore, it’s recently come out that the US may have a major issue in this area. Currently, there are between 300 and 500 large, Chinese-manufactured transformers running inside the US power grid. This is bad because in 2019 federal authorities seized a massive 500,000-pound transformer that had been manufactured by Jiangsu Huapeng Transformer Co (JSHP) at the port of Houston. When examined at Sandia National Laboratories, it was found that the transformer contained embedded hardware backdoors that would allow the transformer to be remotely switched off. This shows a very deliberate and novel method of attack. My fear is that the devices would also allow the transformer to “short” and therefore overheat and destroy itself.
There is no benign or innocent explanation for the addition of this hardware. The only reason it was added was because it was planned to be eventually used.
What gets attacked, and how it reaches you
Understand the target list and you know exactly what to prepare for.
- The grid. Attacks on utility control systems — the industrial control and SCADA systems that run power distribution — cause outages. This reaches you as a normal blackout, just one that may be harder to predict than a weather outage. What makes the grid attractive to a state is how concentrated it is: reporting in The Wall Street Journal described Wellinghoff’s finding that knocking out as few as nine key substations could black out the entire country.
- Money. This is the twist that makes cyber different from a storm. Attacks on banks, payment processors, and ATM networks can freeze your access to funds even with the power on. Nothing is physically broken — you just can’t pay. Card readers reject, ATMs sit empty, online banking is down. That’s not a power problem; that’s a money problem, and it’s why cash is the signature cyber prep.
- Phones and internet. Attacks on telecom and internet lines degrade calls, data, and the flow of information — cutting you off from news and from each other.
- Water. Water treatment and distribution increasingly run on networked control systems and are recognized targets, reaching you as a water outage or a boil-water order.
- The information layer. State cyber operations often pair the technical attack with deliberate lies — disinformation meant to sow confusion, panic, or distrust. Part of your prep is deciding which sources you trust before the confusion starts.
The thread tying all of it together: every one of these lands on your household as a specific service going out. Prepare service by service and you’re covered no matter what the attack technically was.
How likely, honestly
Mid-scale and trending up. Offensive cyber capability is now a standard part of state power, used below the line of open war — probing, positioning, showing off — and ramping up during active conflict and international tension. For a household, the practical read: a service-disrupting cyber event is a real possibility over the coming years, more likely during periods of international friction. It’s not a background certainty, but it’s plausible enough, and cheap enough to cover with dual-use outage prep, that ignoring it is the only real mistake.
What preparedness looks like
The design rule: build outage resilience service by service, then add the cyber-specific layers a weather outage doesn’t stress — cash, offline records, and trusted sources. Measure it in days you can run without each system, not dollars.
The utility-outage foundation. Everything you’d build for a multi-day grid failure applies straight across: stored water and no-power food, safe backup heat, light, and independent power for phones and essential devices. This is the bulk of the work, and it does double duty for every storm and blackout you’ll ever see.
Cash — the signature move. Keep a reserve of physical cash in small bills — fives, tens, and twenties — enough for one to two weeks of essentials. Do the arithmetic for your household: two weeks of groceries, fuel, and a pharmacy run for a family lands somewhere in the low hundreds of dollars, so that’s the order of magnitude to keep on hand. Small bills matter because making change becomes impossible in a cash-only scramble — nobody can break a hundred. This is the single most cyber-specific, highest-value thing you can add.
Offline records. Don’t let a systems outage lock you out of your own life. Keep paper copies of the essentials — account numbers, key contacts, important documents, insurance and medical details — and keep offline backups of important digital data. If the cloud and online banking are unreachable, your paper copies keep you running.
Battery-powered comms and trusted information. Keep a battery or hand-crank radio for news when the internet is down, a charged battery bank, and — this is the part people skip — a short list of information sources you trust, decided in advance, plus a family communication plan. Choosing who and what you believe before the crisis is your defense against the lies that ride in with the attack.
Basic personal cyber hygiene. State attacks target infrastructure, but the same tense periods bring more ordinary criminal hacking too. Strong unique passwords, multi-factor authentication, and backups protect your own household’s data — a modest, worthwhile add-on.
Bottom Line
- Cyber war attacks the systems between you and your essentials, not you — so it always reaches you as a service outage you can prepare for service by service.
- Moderate impact (6/9), rising likelihood (4/9): it shuts things off more than it knocks them down, and it usually comes back in days — but plan for the longer tail.
- The utility-outage foundation covers most of it — water, food, heat, power, light — and it’s fully dual-use with every storm.
- Cash in small bills is the signature cyber prep, because the money can fail while the power stays on.
- Add offline records and trusted sources so a systems failure can’t cut you off from your money or the truth.
You can’t defend the grid or the banks. But you can make sure that when the systems between you and your essentials go down, the cash, the water, and the radio are already on your side of the gap.
Build the utility-outage foundation with Food & Water Storage and the Heating Fuel Calculator, and keep paper copies of critical records in the Digital Binder.