Can hackers cause a blackout? What the agencies have documented

MacWindowsiPhoneAndroidUpdated

Yes. The US Cybersecurity and Infrastructure Security Agency (CISA) documents that on 23 December 2015, remote cyber intrusions at three regional electricity distribution companies in Ukraine caused power outages affecting approximately 225,000 customers. Agencies have since described further attacks on energy companies, and groups they say are positioning themselves inside critical infrastructure networks.

Quick answer

Yes. CISA says power outages in Ukraine in December 2015 "were caused by external cyber-attackers" who remotely operated breakers at three distribution companies. The UK and EU member states have attributed a December 2025 attack on Poland's energy grid to Russia's FSB Centre 16. Households can't defend the grid, but they can prepare for any power cut.

Has a cyber attack ever caused a blackout?

Yes, in Ukraine in 2015. CISA's alert on the attack says intrusions at three regional power distribution companies caused outages affecting about 225,000 customers, and that the attacks at each company happened within 30 minutes of each other. Power was restored, but CISA says the affected companies continued "to run under constrained operations".

CISA describes how it was done:

  1. The companies believe the attackers obtained legitimate credentials beforehand.
  2. Several external operators then operated breakers remotely, using existing remote administration tools or industrial control software over a VPN.
  3. They ran KillDisk, malware that erases files, at the end of the attack.
  4. They corrupted the firmware of devices at substations, which left those devices unusable.
  5. They scheduled the servers' uninterruptible power supplies to disconnect, which CISA assesses was an attempt to interfere with restoration.

Each company had also been infected with malware called BlackEnergy, reportedly delivered in phishing emails with Office attachments, though CISA says its role in the outages is unknown. In a 2021 update, CISA says the US Government attributes the activity to Russian nation-state cyber actors.

What other attacks on energy have agencies described?

The NCSC, the UK's National Cyber Security Centre, said on 13 July 2026 that the UK and EU member states had formally attributed the December 2025 attack on Poland's energy grid to Russia's FSB Centre 16. The NCSC says the attack "could have caused 500,000 civilians to lose electricity" had it been successful.

ENISA, the EU's cybersecurity agency, describes December 2025 attacks against 30 wind and photovoltaic farms in Poland in its May 2026 report, published before that attribution. It says they exploited internet-facing devices and weak credentials, deployed wiper malware, damaged remote terminal units and disrupted communication between the farms and distribution operators, without affecting continuous energy production.

In February 2024, CISA, the NSA and the FBI warned that a Chinese state-sponsored group they call Volt Typhoon was pre-positioning itself on IT networks for disruptive or destructive cyber attacks against US critical infrastructure. The compromises they found were primarily in the communications, energy, transport, and water sectors, and in some networks the group had kept access for at least five years. The advisory reports access and preparation. It says the agencies are concerned about the potential for disruption if geopolitical tensions rise or military conflict breaks out.

What does AI change?

ENISA says AI helps both sides. In its May 2026 report it says AI "makes advanced offensive capabilities more widely accessible" while increasing the scale and sophistication of attacks, and that its benefits have so far materialised faster for attackers than for defenders. For the energy sector, ENISA expects the threat picture to become more complex because of AI-driven developments, geopolitical tensions and supply chain dependencies.

ENISA says organisations now need to detect and respond to threats, and manage vulnerabilities, in much shorter timeframes than they traditionally did. For how official bodies describe AI in attacks more widely, see AI cyber attacks explained.

Who protects the power grid?

Several bodies have a role.

  • In North America, NERC, the North American Electric Reliability Corporation, oversees reliability and security for a bulk power system that serves approximately 400 million people. It develops and enforces mandatory Reliability Standards, can impose penalties for non-compliance, and shares grid security intelligence and threat indicators with operators.
  • In the US government, the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER) works to reduce risks to the nation's energy infrastructure from cyber and other emerging threats, including cyber incident response and recovery. CISA says all critical infrastructure sectors have some dependence on the energy sector.
  • In the UK, the NCSC managed more than 200 cyber incidents affecting critical national infrastructure and its supporting ecosystem in the year to May 2026, and says around 75% of those are believed to be linked to state actors. After the Poland attribution it urged organisations to use strong, unique passwords on network devices and restrict access to management protocols.
  • In the EU, ENISA rates electricity as the most mature part of the energy sector for cybersecurity, in its high maturity band.

What can a household do?

You can't defend the grid from home, but you can be ready for a power cut, whatever causes it, and keep your own devices secure. These steps come from Ready.gov, the US government's preparedness site, and the NCSC's Cyber Aware advice.

Before a power cut:

  1. Plan for alternative power sources, such as a portable charger or power bank, and keep phones charged.
  2. Keep a torch for everyone in the household.
  3. Find out whether your home phone works in a power cut, and how long any battery backup lasts. See does Wi-Fi work in a power cut?
  4. If anyone relies on a powered medical device or refrigerated medicine, talk to your medical provider about a plan.

During a power cut, follow the steps in what to do in a power cut.

For your own accounts and devices, the NCSC's Cyber Aware actions are to protect your email with a strong, separate password, install the latest software and app updates, turn on 2-step verification, and back up your data.

Banking apps down on 20 October 2026? The Google Cloud outage guide explains what Google says happened and what to do when your bank's app is down.

More questions

Who was behind the 2015 Ukraine grid attack?

In a 2021 update to its alert, CISA says the US Government attributes the activity to Russian nation-state cyber actors. The alert itself notes that the response team couldn't review the technical evidence independently, and that interviews and documents corroborated the events.

Did the 2025 attack in Poland cut the power?

The NCSC says that had the attack been successful, it "could have caused 500,000 civilians to lose electricity". The UK and EU member states formally attributed it to Russia's FSB Centre 16 on 13 July 2026.

Is the UK grid a target?

In 2023 the NCSC described the threat to the UK's most critical infrastructure, which it says includes electricity, as "enduring and significant", amid a rise of state-aligned groups. In June 2026 it said around 75% of the more than 200 incidents it managed affecting critical national infrastructure and its supporting ecosystem in the year to May 2026 are believed to be linked to state actors.

What is Volt Typhoon?

It's the name CISA, the NSA and the FBI give a Chinese state-sponsored group. Their February 2024 advisory says it was pre-positioning on US critical infrastructure IT networks, including in energy, with access to some networks for at least five years, for possible disruptive or destructive attacks.

Can AI help hackers attack the grid?

ENISA says AI makes advanced offensive capabilities more widely accessible and increases the scale and sophistication of attacks, and expects the energy sector's threat picture to become more complex as a result. It doesn't name a blackout caused by AI.

Sources