Why I believe America's critical infrastructure could become the next major battlefield, and why a coordinated cyberattack on just a few cities could create panic across the entire country.
It's 7 a.m. You wake up, grab your phone, and begin your usual morning scroll. Except today's headlines are unlike anything you've ever seen.
Los Angeles. New York City. Chicago. Washington, D.C.
All four cities are reporting widespread outages affecting electricity, running water, cellular communications, and natural gas. Millions of Americans are suddenly without essential services. Federal authorities suspect a coordinated cyberattack by a hostile nation-state.
You look around your house. Your lights are on. Your water works. Your phone has service. For now, everything seems normal. But then comes the thought that changes everything.
What if my city is next?
Within hours, imagine grocery stores across the country struggling to keep bottled water on shelves. Gas stations have lines around the block. Generators, batteries, and emergency supplies become difficult to find. Millions of Americans who haven't lost a single utility begin preparing as though they're next.
Four major cities have been attacked, yet the consequences are being felt nationwide. And that is precisely my concern. A hostile nation-state wouldn't necessarily need to shut down the entire United States to create a national crisis.
To be clear, this opening is a hypothetical scenario. It hasn't happened, and there is no public evidence demonstrating that an adversary can simultaneously disable every essential service across four major American cities. But the vulnerabilities that make elements of this scenario worth considering are very real.
Over the past six months, we've seen documented cyberattacks against American water infrastructure, federal warnings about compromised industrial control systems, and continued evidence of foreign adversaries targeting the technology that keeps our communities functioning.
Hypothetical scenario, not an actual event.
We've Spent 40 Years Watching Cyberattacks Evolve
For decades, much of the cybersecurity conversation has revolved around stolen information, ransomware, intellectual property, and corporate risk. Those threats remain significant, but the evolution of cyberattacks has introduced another dimension. We're no longer talking exclusively about protecting information. We're talking about protecting the physical systems responsible for delivering water, electricity, fuel, and other services Americans depend on every day.
In 1988, the Morris Worm demonstrated how malicious code could spread across connected computers and disrupt networks. By 2000, the ILOVEYOU worm demonstrated the financial consequences of malware operating at internet scale. Both were major milestones, but neither was designed to physically destroy industrial machinery.
Then came Stuxnet in 2010, which changed the conversation entirely. Malicious software had been used to physically damage Iranian nuclear centrifuges by manipulating industrial control systems. In 2017, WannaCry and NotPetya demonstrated how rapidly cyber incidents could disrupt hospitals, manufacturing, transportation, and global businesses. The SolarWinds compromise, discovered in 2020, further demonstrated how a trusted software supply chain could provide attackers with access to organizations that would otherwise be difficult to penetrate.
These attacks involved different motivations and techniques, but they demonstrated the increasing potential for cyber operations to produce consequences far beyond compromised data. Today, artificial intelligence introduces additional concerns about the speed and scale of reconnaissance, vulnerability discovery, and exploitation.
The convergence of traditional information technology, operational technology, cloud connectivity, and automation means that the attack surface increasingly extends into the physical world.
And in 2026, we've received some significant reminders of what that means.
2026: The Evidence Is No Longer Theoretical
On May 21, 2026, the U.S. Government Accountability Office testified before Congress about persistent cybersecurity weaknesses affecting approximately 170,000 American drinking water and wastewater systems. The agency highlighted aging technologies, limited financial resources, workforce shortages, and increasing connectivity between operational technology and internet-accessible systems. These aren't hypothetical vulnerabilities. They're documented weaknesses affecting infrastructure that millions of Americans rely on.
Source: U.S. Government Accountability Office, May 21, 2026
Then, on July 22, CISA and its federal partners updated a cybersecurity advisory concerning Iranian-affiliated threat actors targeting programmable logic controllers, or PLCs, across American critical infrastructure. These industrial computers help operate physical equipment such as pumps, valves, and automated machinery. Federal authorities documented malicious activity involving industrial controller configurations, manipulation of operational displays, and incidents resulting in operational disruptions and financial losses. The updated advisory expanded the scope of observed targeting beyond Rockwell Automation equipment to include Schneider Electric and Siemens controllers.
Source: CISA Joint Cybersecurity Advisory, updated July 22, 2026
Just days later, between July 26 and July 30, Minnesota officials confirmed malicious cyber activity targeting technology associated with more than 30 community water systems. In Braham, attackers interfered with the control systems operating a municipal well and water treatment plant, temporarily interrupting automated operations. Other communities experienced problems involving monitoring equipment and communications, although most maintained water service through contingency procedures.
Minnesota officials made an important distinction: confirming malicious activity at a water system does not mean that community necessarily lost water service. The state also declined to publicly attribute the incidents to a particular threat actor while investigations continued.
Source: Minnesota IT Services, July 30, 2026
On July 30, the FBI and Environmental Protection Agency issued a warning confirming that water and wastewater utilities in at least seven states had reported incidents involving industrial controllers, with some experiencing degraded water operations. Attackers were accessing internet-facing devices, changing configurations and passwords, and interfering with operators' ability to monitor or control equipment. The FBI documented operational effects including water-pressure loss and flooding.
Source: FBI and EPA Public Service Announcement, July 30, 2026
And on October 8, the Department of Justice announced the seizure of infrastructure associated with Flax Typhoon, a Chinese state-sponsored hacking operation. Investigators described tools used to scan and, in some cases, compromise networks, with identified reconnaissance targets including an American electric utility in South Carolina. While that disclosure does not establish that the utility suffered an outage, it demonstrates continued interest in identifying weaknesses across critical infrastructure.
Source: U.S. Department of Justice, October 8, 2026
These disclosures involve different actors, techniques, and levels of severity. They are not proof of one coordinated nationwide campaign. But collectively, they establish something important: foreign adversaries are actively targeting the technology that supports America's essential infrastructure, and in some documented cases they have already demonstrated the ability to interfere with physical operations.
That brings me to my theory.
My Theory: Attack a Few Cities, Disrupt an Entire Country
I believe one of the more concerning scenarios for a future major cyber crisis involves a sophisticated nation-state coordinating disruptions against selected critical infrastructure systems in multiple American metropolitan areas.
It doesn't require taking every city completely offline. Even partial disruptions to electricity, water, or telecommunications in several major cities could have significant consequences, particularly if the incidents happen close together and appear to be part of a coordinated campaign.
The problem is that modern infrastructure is deeply interconnected. Electricity supports water treatment facilities, telecommunications networks, traffic signals, hospitals, fuel distribution, and countless other essential operations. Water systems depend on pumps, industrial controllers, communications, and reliable power. Transportation, banking, and emergency services depend on combinations of these same technologies.
A cyberattack against one system doesn't automatically disable everything connected to it. Utilities have generators, backup equipment, manual operating procedures, and emergency response plans designed to maintain essential services during disruptions. But those protections can be tested when several dependent systems are experiencing problems simultaneously.
Consider a water utility investigating unauthorized changes to its industrial controllers while local communications are degraded and the electrical grid is experiencing instability. Even if each utility has its own recovery plan, coordinating a response becomes considerably more complicated when the organizations they depend on are also struggling to restore operations.
Now multiply that challenge across several major metropolitan areas.
An adversary wouldn't necessarily need to compromise every piece of infrastructure. Selective disruptions against interconnected services could generate consequences far beyond the individual systems that were directly attacked.
Service dependencies can amplify a disruption, but the failure of one system doesn't automatically cause every other system to fail.
The Real Weapon Might Be Panic
This is the part of my theory that concerns me more than the cyberattack itself.
Suppose three or four major metropolitan areas experience significant infrastructure disruptions, and federal authorities suspect a foreign nation-state. Television networks shift into continuous coverage. Social media fills with footage of darkened neighborhoods, crowded gas stations, emergency vehicles, and residents lining up for bottled water. Speculation spreads almost immediately about which cities might be targeted next.
Meanwhile, the overwhelming majority of Americans still have electricity, running water, and cellular service. Their communities haven't been attacked, but they're watching the situation unfold in real time, wondering whether they could be next.
The result could be a wave of precautionary buying that extends well beyond the affected cities. Bottled water, generators, batteries, emergency radios, and shelf-stable food could become difficult to find in certain markets. Online retailers might experience surging demand, while misinformation and unverified reports could amplify public uncertainty.
This is where the potential psychological impact becomes as interesting as the technical attack itself.
From an adversary's perspective, the damage may not be limited to the infrastructure they successfully compromise. The fear of additional attacks could create secondary consequences through consumer behavior, business interruptions, supply-chain pressure, and declining public confidence.
I'm not suggesting nationwide panic would be inevitable. Clear communication from government officials, credible news reporting, effective emergency management, and rapid restoration of affected services could significantly reduce that risk. But the possibility of a disproportionate national response deserves serious consideration.
The technical damage might be regional. The psychological and economic impact could be national.
And that changes how we should think about the consequences of critical infrastructure attacks.
Could a Nation-State Shut Down the Entire United States?
Let's address the Hollywood version of this scenario. Could a sophisticated adversary launch coordinated cyberattacks against electricity, water, telecommunications, and other essential services across the entire country?
In theory, multiple critical infrastructure sectors could be targeted as part of a broad campaign. But a complete, simultaneous shutdown of every essential service nationwide would be extraordinarily difficult, and I consider that scenario far less plausible than selective disruptions against individual cities or regions.
America's infrastructure is geographically distributed, operated by thousands of independent organizations, and built around a wide variety of technologies, architectures, and operating environments. That diversity creates enormous security challenges, but it also makes a single coordinated nationwide failure considerably harder to achieve.
There's no universal switch that turns off the entire country's electricity, water, cellular service, and natural gas distribution simultaneously. Different organizations operate these systems, with varying levels of connectivity, redundancy, and contingency planning.
That's why I believe the more credible threat is not a complete nationwide blackout, but a limited number of coordinated attacks that create consequences far greater than their geographic footprint.
We don't need to imagine every American city going dark to recognize the danger of several major cities experiencing significant disruptions at the same time.
How Long Could These Systems Stay Offline?
My working assumption is that many services affected by a limited cyberattack, particularly one that doesn't involve substantial physical equipment damage, could potentially recover within hours to several days.
We've already seen examples of relatively rapid restoration. During the July Minnesota incidents, operators in Braham restored their water system in approximately 90 minutes. Other affected communities maintained operations through manual procedures while automated systems were investigated or restored.
Source: MPR News, July 28, 2026
But there's an important difference between restoring access to an industrial controller and replacing physically damaged infrastructure. If attackers successfully destroy equipment, corrupt critical engineering systems, or damage components that cannot be quickly replaced, restoration could take significantly longer.
In October 2026, the Department of Energy discussed multi-year procurement lead times affecting certain electrical grid components, including transformers. Those supply-chain limitations could complicate recovery from a destructive incident involving significant physical damage.
Source: U.S. Department of Energy, October 26, 2026
For household preparedness, I believe planning around a 72-hour to seven-day interruption is reasonable. That's not a prediction that an attack would last a week. Some incidents could be resolved in minutes or hours, while more destructive events could take weeks or longer to recover from.
I'm simply suggesting that every American household should be capable of handling several days without the basic services we've become accustomed to having available around the clock.
Prepare, Don't Panic
I don't believe Americans need to live in fear of a cyberattack. Nor do I think every household needs a bunker, a year's worth of food, or an elaborate survival plan. What I do believe is that basic emergency preparedness should become as routine as maintaining a first-aid kit or checking the batteries in your smoke detectors.
Every household should be capable of functioning for at least three days without reliable electricity or running water, ideally working toward a full week or more where practical. That doesn't require an enormous financial investment or a garage filled with emergency equipment.
The CDC recommends storing at least one gallon of drinking water per person per day for a minimum of three days, with a two-week supply encouraged when practical. Those requirements can increase for households with pets, medical needs, or exposure to extreme heat.
Source: CDC Emergency Water Storage Guidance
At a minimum, I'd recommend keeping these essentials readily available:
- Drinking water and nonperishable food
- Flashlights and spare batteries
- Charged power banks and backup charging equipment
- A battery-powered or hand-crank emergency radio
- First-aid supplies and necessary prescription medications
- Basic sanitation and hygiene supplies
- Copies of important documents in a waterproof container
- A plan for communicating with family members when cellular networks are unavailable
These same supplies would prove useful during hurricanes, wildfires, winter storms, regional blackouts, and countless other emergencies. You don't need to believe that a catastrophic cyberattack is inevitable to recognize the value of being prepared.
In fact, preparedness may be one of the simplest ways to reduce the secondary effects of a large-scale crisis. Households that already have essential supplies are less likely to rush stores simply because they're watching an emergency unfold somewhere else.
The less uncertainty people feel about their own immediate needs, the less likely they are to contribute to a broader panic.
The Bigger Picture
The cybersecurity industry has spent decades focusing on stolen records, ransomware payments, compromised accounts, and corporate financial losses. Those threats haven't disappeared, but operational technology changes the stakes. When attackers interfere with industrial systems, the consequences can move from the digital world into the physical one.
We're no longer measuring the impact of every cyberattack exclusively in dollars or stolen records. Sometimes the impact is measured in water pressure, electricity distribution, fuel availability, and the ability of hospitals or emergency responders to function.
That demands a different approach to security. We need stronger architectures that eliminate unnecessary exposure of industrial controllers, better visibility into operational technology, strict segmentation between trusted systems and untrusted networks, zero trust access for anyone who interacts with critical infrastructure, and tested recovery procedures that allow essential services to continue when digital systems are compromised.
More importantly, we need to recognize that infrastructure resilience is no longer exclusively an engineering or operational concern. It's a cybersecurity concern, an economic concern, and increasingly a national security concern.
The events of the past six months aren't proof that America is on the verge of a coordinated infrastructure collapse. But they should serve as a warning that adversaries are targeting the physical systems supporting our modern way of life, and that some have already demonstrated the capability to interfere with their operations.
My concern is that the next truly consequential cyber crisis might not be measured by how many records were stolen, how much ransom was demanded, or how many networks were compromised. It might be measured by how many Americans suddenly find themselves without the essential services they've depended on their entire lives.
And perhaps more importantly, by how the rest of the country reacts.
You don't need to shut down America to bring America to a standstill.
I really hope I'm wrong about this one.