A state-linked cyber attack cuts power, water or a port for a day or more
The test Between 26 Oct 2026 and 25 Oct 2027, a cyber attack that a national government or its cyber agency attributes on the record to a state or state-linked actor cuts power or piped water to at least 100,000 people, or halts cargo operations at a seaport, for 24 hours or more, in a G20 member, an EU member state or Norway.
Not under way · Confidence: medium · Reviewed 25 Oct 2026 · Scores from 1 to 10
This page answers: What could happen, how it is scored, and who is exposed?
Using this page
- Read the two scores: Likelihood and Impact are kept apart.
- Check what is happening, each fact with its source.
- Use the calendar for the dates to watch.
Follow this riskSign in to follow; one weekly email if you ask for it.
Likelihood ↑ 30 Jul 2026: FBI and EPA report attacks degrading water operations in at least seven US states; a small UK generator shut for four days in July, reported 23 Aug. Before 30 Jul the score would have been 3.
Impact is the average of the four parts, rounded, plus one point when Canada is directly hit on two or more channels, up to 10.
Two separate scales from 1 to 10. Strature never multiplies or merges them.
What changed
Dated, newest first
- 8 Oct 2026: CISA's Chris Butera said China-government-affiliated actors, using tools the agencies say come from Integrity Technology Group, are positioning in critical infrastructure networks including OT, to disrupt 'at a future time of their choosing' [1]
- AA26-281A co-sealed by agencies of the UK, Australia, Canada, Japan, New Zealand and Spain [2]
Why it matters
Three near misses since December 2025: a Russia-blamed attack on Polish energy sites in Dec 2025 with no outage, attacks on US water controls in at least seven states from 27 Jul 2026, and a small UK generator shut for four days in July with no customer outage. On 8 Oct 2026 the US and partners, Canada among them, issued an advisory on China-linked intrusions; a CISA official said such actors are positioning inside networks including OT. No case yet meets all three tests: a customer outage, a day or more, and an official attribution.
Why Likelihood 4 Pushes: an active Iran-linked campaign, China-linked access in OT, Russia's attack on Polish energy. Brakes: manual fallback held where an outcome was reported; governments slow to attribute; a state that causes an outage invites a response.
Why Impact 4 Threshold case: one 24-hour outage for 100,000 people, or one port.
The other facts on file (8)
- Feb 2024: PRC actors pre-positioning for disruptive attacks; footholds for at least five years [3] (7 Feb 2024)
- Since 27 Jul 2026, water utilities in at least seven US states reported PLC attacks; loss of pressure and flooding; no state actor named [4] (30 Jul 2026)
- 5 Aug 2026: ABC News, citing unnamed sources, reported possible attacks in at least a dozen states and a suspected Atlanta pump outage with a boil-water order; no official attribution [11] (5 Aug 2026)
- Clayton County Water Authority (Georgia) investigating cyber activity that may have contributed to a pump-station disruption; boil advisory; no duration given [12] (4 Aug 2026)
- Small UK generator shut four days in July 2026 (reported 23 Aug as last month); no wider risk, per the government; no official attribution [6] (23 Aug 2026)
- Poland came 'very close to a blackout' in late Dec 2025; no outage [7] (14 Jan 2026)
- CERT Polska attributed attacks on 30 renewable sites and a CHP plant serving nearly 500,000 customers to Russia's FSB; ESET tied the malware instead to Sandworm [8] (31 Jan 2026)
- Canadian Cyber Centre: state actors very likely targeting Canadian and allied critical infrastructure to prepare disruptive operations [9] (20 Sep 2024)
Where it sits
How it spreads
Between 26 Oct 2026 and 25 Oct 2027, a cyber attack that a national government or its cyber agency attributes on the record to a state or state-linked actor cuts power or piped water to at least 100,000 people, or halts cargo operations at a seaport, for 24 hours or more, in a G20 member, an EU member state or Norway.
Not under wayChannels 4 on the card
- CanadaCanada co-sealed the advisory; integrated North American grids, pipelines and rail would carry an attack into Canada.
- Grids, water and portsRegulators order controllers off the open internet and manual fallbacks.
- InsuranceState attribution tests war and state-actor exclusions in cyber and property cover (Strature's view).
- Security and alliancesAttribution to China, Russia or Iran raises pressure for a response.
Sectors 3
- Energy and pipelines
- Ports and logistics
- Banks and insurers
Countries 7
- United States primary
- United Kingdom
- Poland
- Canada
- China primary
- Russia primary
- Iran primary
Who is exposed
- Countries
- United States, United Kingdom, Poland, Canada, Japan, Australia
- Sectors
- Energy and pipelines, Ports and logistics, Banks and insurers
Three scenarios and their signposts
- S1
Near misses continue
Attacks degrade operations, manual control restores them within hours, and attribution stays informal.
- S2
First attributed outage
A grid, water system or port is down for a day and a government names the state behind it.
- S3
Wartime campaign
In a Taiwan or Iran crisis, pre-positioned access is used against several systems at once.
| Path | Signpost |
|---|---|
| S1 | A new FBI or CISA notice with no named state actor |
| S2 | An official attribution within weeks, as CERT Polska gave |
| S3 | A joint advisory reporting active disruption, not only access |
No probability is given for the three paths.
Dates to watch
The dates to watch
A dot is a day, a bar a month or a year; a hollow mark is tentative. The line marks today.
- 3 Nov 2026 US midterm elections; FBI notices on threats to election officials [10] Declared · Outside event
Sign in, with alerts on, for an email 7 days and 1 day before.
The other side
The near misses with a reported outcome have been met by manual fallback and restoration; the Georgia pump outage gave no duration. Spending on secure controllers, segmented networks and trained crews is an opening for Canadian and allied suppliers and utilities.
Connected in Strature
- United States
- United Kingdom
- Poland
- Canada
- China
- Russia
- Iran
- Ransomware halts a major port, hospital network or pipeline for three days or more Shares a channel: The same targets, hit by criminal actors.
- A cyberattack halts a French food, health or transport service for a day or more Shares a channel: A narrower national case of an essential service halted.
- A cyberattack halts a UAE port, airport or energy site for a day Shares a channel: A narrower national case for UAE ports, airports and energy.
- The Strait of Hormuz shuts again Driven by: The Iran conflict behind the summer attacks [6].
- China squeezes Taiwan's sea lanes: quarantine or blockade Driven by: Pre-positioned access is meant for a crisis [3].
- Two or more undersea cables or pipes cut in one Baltic or North Sea incident Shares a channel: Sabotage of infrastructure by state-linked actors.
Sources
11 sources, numbered as the text cites them
- CISA, FBI, NSA and international partners warn of China-based cybersecurity company enabling threat actors to target multiple critical infrastructure sectors worldwide. CISA · 8 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
- AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data. CISA · 8 Oct 2026 · Official · confidence high · retrieved 25 Oct 2026
- AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. CISA · 7 Feb 2024 · Official · confidence high · retrieved 25 Oct 2026
- I-073026-PSA: Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs, Causing Operational Disruptions. FBI and EPA · 30 Jul 2026 · Official · confidence high · retrieved 25 Oct 2026
- Iran-linked hackers accused of cyberattack that shut down British power plant. The Irish Times (The Guardian) · 23 Aug 2026 · News · confidence medium · retrieved 25 Oct 2026
- Poland says it repelled a major cyberattack on its power grid, blamed on Russia. The Record (Recorded Future News) · 14 Jan 2026 · News · confidence high · retrieved 25 Oct 2026
- Poland traces December cyberattacks on 30 energy sites to Russian spy agency. Euromaidan Press (relaying Reuters) · 31 Jan 2026 · News · confidence medium · retrieved 25 Oct 2026
- National Cyber Threat Assessment 2025-2026. Canadian Centre for Cyber Security · 20 Sep 2024 · Official · confidence high · retrieved 25 Oct 2026
- Public Service Announcements, 2026. FBI Internet Crime Complaint Center · 23 Oct 2026 · Official · confidence medium · retrieved 25 Oct 2026
- At least a dozen states report cyberattacks on water utilities, sources say. ABC7 Chicago (ABC News, CNN Wire) · 5 Aug 2026 · News · confidence low · retrieved 25 Oct 2026
- Ga. water system's woes could be tied to cyberattack. WRDW (Gray Media) · 4 Aug 2026 · News · confidence medium · retrieved 25 Oct 2026
Reviewed 25 Oct 2026 · version 1 · last change: reviewed · All risks