Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Foreign hackers could disrupt essential services if they gain access to operational technology that monitors or controls utility equipment. Recent U.S. advisories describe attacks on internet-connected devices at water, energy and government organizations, and water utilities have reported real operational problems. But the available reports do not show that attackers have collapsed the U.S. electric grid—or that one cyberattack could inevitably knock out power nationwide.

How could foreign hackers disrupt a utility?

Utilities use operational technology (OT) to monitor and control physical processes. A programmable logic controller (PLC), for example, can receive information from equipment and carry out programmed actions. Operators may view that information through human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) systems.

If attackers reach an exposed PLC or another part of this control environment, they may interfere with what operators can see or do. The effect depends on the device’s role, the equipment it controls, how the network is configured and whether staff can safely switch to manual procedures. An account or device compromise is not, by itself, proof that an attacker can control an entire utility.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the recent advisories describe

In a July 22, 2026 update, the Cybersecurity and Infrastructure Security Agency (CISA) described Iranian-affiliated activity targeting internet-connected OT devices, including PLCs, across water, energy and local-government environments. CISA said the activity included attempts to download malicious project files and manipulate data shown on HMI and SCADA displays, disrupting operations and causing financial losses for affected organizations. The update described targeting of Rockwell Automation, Schneider Electric and Siemens devices, among others. “Iranian-affiliated” is the agency’s characterization; it does not establish that a particular government directed every incident.

#1 Best Overall
Eaton CHSPT2ULTRA Ultimate Surge Protection 3rd Edition, 2.38" Length, 5.25" Width 7.5" Height
  • Universally connects to any manufacturer’s load center (breaker box)
  • Easy to use
  • High quality product
  • Universally connects to any manufacturer’s load center (breaker box)
  • Easy to use

A separate July 30, 2026 public service announcement from the FBI and the Environmental Protection Agency (EPA) described actors remotely accessing exposed PLCs at water and wastewater utilities. The agencies reported changed device IP addresses and passwords that left operators without monitoring, and in some cases control, of connected equipment. Some victims also reported altered PLC project files. The agencies had observed this behavior with Allen-Bradley MicroLogix 1100 and 1400 PLCs and advised operators to consider similar precautions for other PLC brands.

What effects have been reported—and what has not

Water and wastewater systems

The FBI and EPA said water and wastewater companies in at least seven states had reported incidents since July 27, 2026. That figure counts states reporting incidents, not affected utilities or customers. Some incidents degraded water operations: reported effects included loss of pressure and flooding. If water pressure falls, untreated groundwater can potentially seep into pipes. The agencies did not describe these reports as a nationwide water emergency.

Rank #2
Square D by Schneider Electric HOM2175SB Homeline SurgeBreaker, Surge Protection Device, 25kA, 120/240V, 1-Phase, 3-Wire
  • Equal protection to circuits and receptacles throughout home
  • Includes an LED indicator
  • Can be used in service entrance locations, CSEDs and Homeline load centers
  • Plug-on installation, requires 2 spaces
  • UL 1449 3rd Edition Listed

Electricity and the national grid

CISA’s July 22 advisory includes energy environments in its description of targeted sectors, but the FBI and EPA’s July 30 incident count concerns water and wastewater utilities. Those water-sector reports should not be presented as electric-grid outages.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The Department of Energy’s (DOE) 2018 grid assessment identified gaps in response capacity, planning, scarce resources and the analysis of incident impacts. It also said that, up to that assessment, no lasting physical or cyber-physical damage had been observed from reported cyberattacks and intrusions targeting U.S. electric utilities. That is a dated finding, not a current count of all incidents or proof that severe damage is impossible.

Rank #3
Furniqro FHSPD108S Whole House Surge Protector for 108,000 Amps, Ultimate Surge Protection, Whole Home Surge Protector for Indoor/Outdoor Use, 120/240V
  • Whole House Surge Protector: FHSPD108S is a compact whole-home surge protector that safeguards electrical devices connected to your home system
  • High-Capacity Compact Design: The FHSPD108S features a sleek and compact form factor that saves space while delivering a robust capacity of up to 108,000 Amps. It combines high capacity with a smaller footprint seamlessly
  • High Compatibility and Adaptability: This whole house surge protector is compatible with any brand of load centers and circuit breakers, designed specifically for surge protection at 120/240V, 60Hz system voltages. Its commercial-grade enclosure offers high adaptability for both indoor and outdoor installations
  • Reliable and Effective Protection: With clear LED status indicators, you'll know your home is being protected. Its true value lies in preventing destructive voltage spikes, reducing the need for frequent appliance replacements and repairs, saving you time and money. Moreover, this device significantly mitigates the impact of extreme weather conditions like thunderstorms, safeguarding your entire home
  • High-Quality After-Sales Service: If your SPD experiences startup issues, they are typically caused by grounding or misuse. It's important that any electrician working in your home is familiar with surge protector protocols. For assistance, please contact us directly for excellent after-sales support

A prolonged power outage after a significant cyber incident is a contingency utilities and government planners need to consider, but the cited material does not give a probability, duration or customer count for a nationwide blackout. Access to one utility network does not establish the ability to cause a cascading national failure. Consequences would depend on what the attacker could reach, what systems were affected, how the grid responded and how quickly operators could recover.

Why some utility incidents become operational problems

Internet exposure can give an attacker a path to a device that was designed to help run a physical process. Changing a PLC’s network settings or credentials can make it harder for operators to monitor or control the equipment it serves. Altered project files can raise a different concern: whether the PLC’s programmed logic is still trustworthy. The reported outcomes are not automatic; a PLC that only monitors status presents a different operational situation from one that directly controls equipment.

Rank #4
Furniqro FHSPD36S Whole House Surge Protector for 36,000 Amps, Ultimate Surge Protection, Whole Home Surge Protector, Indoor/Outdoor Use, 120/240V
  • Whole Home Surge Suppressor: FHSPD36S is a compact whole-home surge protector that safeguards all electrical devices connected to your home system, including computers, security systems, TVs, kitchen appliances, HVAC systems, and smart home devices
  • High-Capacity Compact Design: The FHSPD36S offers a sleek, compact design that saves space while delivering a robust capacity of up to 36,000 Amps, seamlessly combining high capacity with a smaller footprint
  • High Compatibility and Adaptability: This whole house surge protector is compatible with all brands of load centers and circuit breakers, designed for surge protection in 120/240V, 60Hz systems. Its commercial-grade enclosure offers high adaptability for both indoor and outdoor installations
  • Reliable and Effective Protection: With clear LED status indicators, you can monitor your home's protection. This device effectively prevents destructive voltage spikes, thereby reducing the need for frequent appliance replacements and repairs, saving you time and money. Additionally, it helps mitigate the impact of extreme weather conditions like thunderstorms, safeguarding your entire home
  • High-Quality After-Sales Service: If your SPD experiences startup issues, they are typically caused by grounding or misuse. It's important that any electrician working in your home is familiar with surge protector protocols. For assistance, please contact us directly for excellent after-sales support

Recovery also depends on whether operators can move to manual operation, whether backups are intact and verified, and whether other devices or accounts have been reached. The FBI and EPA warned that pressure loss in a water system can have physical consequences, but the sources do not establish one uniform outcome for every utility or PLC.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What utility operators can do

The FBI and EPA’s guidance focuses on reducing exposure, restricting access and preparing to operate and recover safely. These measures are for infrastructure operators, not substitutes for household cybersecurity products.

Best Value
Eaton CHSPT2SURGE SPD Type 2 Chsp Whole Home Surge Protector, Nema 4, Single Phase, 120/240 Volts, Ul 1449 3Rd Edition
  • Ac power protection
  • Universally connects to any manufacturer’s load center (breaker box)
  • Quick connect design—easy to mount cable protection modules
  • Country of origin: China
  • Remove direct public-internet exposure. Do not leave PLCs directly accessible from the internet. Broker necessary remote connections through a secure gateway and secure cellular modems.
  • Restrict access. Use strong, unique credentials; apply access controls; and limit communications with firewall rules or access-control lists.
  • Check control logic and recovery files. Validate PLC logic and project files, review backups before restoring them, and inspect logs and connected devices for signs of further movement through the network.
  • Keep a safe fallback. Maintain manual operating capability and routinely exercise continuity, recovery, fail-safe, islanding, software-backup and standby procedures where applicable.
  • Plan for unsupported equipment. Identify end-of-life devices that no longer receive vendor updates and plan their replacement.

What a new bulk-power equipment order covers

Separately from the incident reports, DOE’s summary of Executive Order 14421, issued August 26, 2026, describes a policy focused on certain foreign-produced bulk-power equipment used in interconnected transmission facilities. The stated scope includes covered transmission lines at 69 kilovolts and above and related control systems, while excluding local distribution. DOE said it would issue implementing rules within 120 days of the order. The summary describes the policy’s intended scope; implementation details remain subject to further action.

This supply-chain policy is distinct from the reported PLC incidents. It addresses equipment in specified bulk-power settings, not every utility device or local distribution system.

Quick Recap

Bestseller No. 1
Eaton CHSPT2ULTRA Ultimate Surge Protection 3rd Edition, 2.38' Length, 5.25' Width 7.5' Height
Eaton CHSPT2ULTRA Ultimate Surge Protection 3rd Edition, 2.38" Length, 5.25" Width 7.5" Height
Universally connects to any manufacturer’s load center (breaker box); Easy to use; High quality product
Bestseller No. 2
Square D by Schneider Electric HOM2175SB Homeline SurgeBreaker, Surge Protection Device, 25kA, 120/240V, 1-Phase, 3-Wire
Square D by Schneider Electric HOM2175SB Homeline SurgeBreaker, Surge Protection Device, 25kA, 120/240V, 1-Phase, 3-Wire
Equal protection to circuits and receptacles throughout home; Includes an LED indicator; Can be used in service entrance locations, CSEDs and Homeline load centers
$78.95
Bestseller No. 5
Eaton CHSPT2SURGE SPD Type 2 Chsp Whole Home Surge Protector, Nema 4, Single Phase, 120/240 Volts, Ul 1449 3Rd Edition
Eaton CHSPT2SURGE SPD Type 2 Chsp Whole Home Surge Protector, Nema 4, Single Phase, 120/240 Volts, Ul 1449 3Rd Edition
Ac power protection; Universally connects to any manufacturer’s load center (breaker box)
$56.72

How to read claims about a utility cyberattack

  • Observed incident: Agencies report specific access or operational effects at identified types of utilities.
  • Agency-attributed activity: An agency characterizes activity as linked to a group or affiliation; that attribution does not automatically prove who ordered each action.
  • Risk scenario: A severe outage is a contingency to prepare for, not evidence that it happened or a quantified forecast that it will.
  • Scope: Water-sector incident reports, electric-grid resilience assessments and bulk-power equipment policy answer different questions and should not be combined into one claim about nationwide collapse.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.