Cyberattack and Infrastructure Failure: The Invisible Emergency

Quick Summary

• A cyberattack on infrastructure gives you zero warning — no forecast, no siren, just a Tuesday that slowly gets weird.
• Fuel is usually the first visible crisis. Colonial Pipeline proved that a billing system failure, not a technical one, can empty 10,000+ gas stations in 48 hours.
• Water treatment is the slower, scarier threat. The Oldsmar, Florida incident showed how close we’ve already come to a real mass-casualty event.
• Most documented attacks resolve operationally within days to two weeks, but secondary effects — fuel prices, supply chains, financial systems — drag on far longer.
• Your prep can’t depend on the same digital infrastructure the attack is targeting. Print your plans. Store cash. Fill your water containers before you need to.

When It Happened Before

The Colonial Pipeline shutdown: chaos at the pump

On May 7, 2021, a single compromised password brought the largest fuel pipeline in the United States to its knees. Colonial Pipeline, which delivers roughly 45% of the East Coast’s fuel supply, shut down completely for six days after a DarkSide ransomware attack. Within 48 hours, panic buying spread across states from Texas to New York. Over 10,000 gas stations ran dry. Lines stretched for blocks. People filled plastic bags with gasoline. Yes, literally plastic bags.

Colonial paid a $4.4 million ransom for a decryption tool so slow they ended up restoring from their own backups anyway. Here’s the part that should bother you: the attack never touched the pipeline’s operational technology. It hit the billing system. The company shut down fuel delivery voluntarily because they couldn’t figure out how to charge for it. A billing glitch starved millions of people of fuel. Sit with that for a second.

Four years earlier, NotPetya — malware disguised as ransomware but built to destroy — tore through global networks in June 2017. Shipping giant Maersk, which handles roughly a fifth of the world’s shipping capacity, lost its entire IT infrastructure overnight. Every one of its 49,000 endpoints, every server, every network device across 600 sites in 130 countries — wiped. Employees coordinated over WhatsApp and personal Gmail accounts for two weeks while container ships sat unable to dock or unload. Total global damages exceeded $10 billion, making it the most destructive cyberattack in history at the time. Maersk wasn’t even the target. The malware was aimed at Ukrainian businesses. That’s the thing about cyber weapons — they don’t respect borders or intentions.

Then there’s the one that should keep you up at night even though nothing bad technically happened. In February 2021, an attacker remotely accessed the water treatment plant in Oldsmar, Florida, and pushed sodium hydroxide levels from 100 parts per million to 11,100 — 111 times the safe threshold. At that concentration, tap water would have caused internal chemical burns. A plant operator happened to be watching his screen and saw the mouse moving on its own. He reversed it within minutes. If he’d been on a bathroom break, or the plant less staffed, or the timing shifted to 3 a.m. — finish that sentence yourself.

And in December 2015, hackers breached Ukraine’s power grid, cutting electricity to 230,000 customers in the dead of winter. First confirmed cyberattack to cause a real-world power outage. Operators had to restore power manually, sending crews to substations to close breakers by hand. They got lights back within hours — but only because their aging infrastructure still had manual overrides. A lot of modernized American utilities don’t have that fallback anymore.

How Much Warning You’ll Actually Get

Zero. That’s the honest answer. Infrastructure cyberattack preparedness is uniquely hard because there’s no lead time built into the scenario. A hurricane gives you days of forecast data. Even an earthquake gives you a few seconds of seismic warning through modern alert systems. A cyberattack is invisible until its effects show up in your daily life. One moment your world works. The next, the gas station can’t process payments, the traffic lights are dark, your tap pressure drops, and your phone can’t connect to anything.

You won’t get an emergency alert telling you a threat actor has penetrated the SCADA systems controlling your regional grid. You’ll get silence, then confusion, then a slow accumulation of small failures that eventually add up to something serious.

That cascade unfolds over hours to days, which is exactly what makes it disorienting. Your card gets declined and you assume it’s a bank glitch. Then you hear the station across town is cash-only. Then the power flickers. Each failure looks isolated at first. By the time the pattern is obvious, panic buying has already started and you’re behind the curve. Urban density accelerates this — more people competing for fewer resources, faster. Rural areas feel it slower thanks to well water and propane heat, but they’re also farther from resupply once distribution chains snap.

The First 72 Hours

Emergency supplies for the first three days

The first hour is defined by confusion, not crisis. Power may or may not be out. Your phone might work for calls but not data. A store’s card reader is down and nobody knows why. This is the window where most people shrug it off — “it’ll be back up in a minute” — while the people who take this seriously are already moving: topping off the car if stations are still running, pulling cash from the wallet (not the ATM, which may already be dead), filling every water container they own from the tap, and switching on a battery-powered or solar-powered radio for real news instead of scrolling social media that may not even load.

Within 12 to 24 hours, the picture sharpens and the mood shifts fast. If it’s an energy-sector attack, fuel becomes the first visible crisis — same pattern Colonial Pipeline showed us. Stations still holding fuel go cash-only, then rationed, then closed. The psychological effect is immediate: people see a line forming and their lizard brain takes over. They top off vehicles that didn’t need it and fill containers they don’t have proper storage for, accelerating the exact shortage they’re panicking about.

If water treatment is the target, you might not notice right away. Municipal systems have reservoir buffers that hold for hours, sometimes a day or two. Once that buffer’s gone and treatment is compromised, you’re looking at a boil-water advisory at best and contaminated supply at worst. This is why stored water isn’t optional gear-nerd territory — it’s baseline. If you’re just getting your supplies organized, The Beginner’s Guide to Survivalism: Prepping for Dummies covers the foundational priorities without overwhelming you.

By 48 to 72 hours, unprepared households are genuinely struggling. ATMs are offline. Open stores are cash-only, and shelves are thinning fast on water, batteries, canned goods, and fuel containers. If the grid’s affected, refrigerated food is spoiling. Anyone dependent on electric medical equipment — CPAP machines, home oxygen concentrators, powered wheelchairs — is in a real emergency now, not a hypothetical one.

Here’s what I’ve learned running WFR scenarios and studying outage data: the thing that actually kills people in this window isn’t the cyberattack itself. It’s the secondary failures. Traffic accidents from dead signals. Carbon monoxide poisoning from generators run indoors or too close to windows. Insulin that can’t be refrigerated. Diabetics who can’t fill a prescription because the pharmacy’s systems are down. These aren’t hypothetical risks — they’re the documented causes of death in every extended power outage on record.

When Days Become Weeks

Past the 72-hour mark, if systems still aren’t restored, the failure cascade follows a fairly predictable order. Fuel goes first, and everything else depends on fuel. No fuel means no delivery trucks, which means no restocked grocery stores, no resupplied pharmacies, no diesel for backup generators running cell towers and hospitals. Supply chains don’t degrade gracefully — they hit a cliff. NotPetya demonstrated this at global scale: when Maersk’s systems went down for two weeks, ports worldwide backed up and the ripple effects lasted months. Now picture that same disruption localized to your region’s fuel, food logistics, and municipal services, all at once.

Water becomes the critical concern between days 3 and 7 if treatment is compromised. Most water towers and reservoirs carry 24 to 72 hours of gravity-fed supply. After that, without power to pumping stations and without functional treatment, you’re dealing with low pressure, no pressure, or water of uncertain safety. Your stored supply and your ability to filter and purify become everything at this point.

Financial systems are the other slow-burn crisis. Even if local power comes back, banking infrastructure, payment processing, and supply chain ordering systems may stay down. Cash is king, but cash has limits when there’s nothing on the shelves to buy it with. This is where neighbors start pooling resources. Communities with real relationships lean on them. Communities without those relationships start fracturing. Having the right camping and emergency gear already sitting in your closet means you’re not improvising cooking, lighting, and water purification from scratch while everyone else is doing the same thing.

Long-Term: If It Doesn’t Resolve Quickly

History gives us a reassuring data point: most infrastructure cyberattacks have resolved within days to two weeks at the operational level. Colonial was back online in six days. Ukraine’s grid was restored within hours locally. But — and this matters — the secondary economic and logistical effects lasted much longer. Fuel prices stayed elevated for weeks after Colonial. NotPetya’s supply chain disruption took Maersk months to fully unwind. And those were single-vector attacks hitting one system, one company.

What keeps defense analysts up at night is a coordinated, multi-vector attack targeting power, water, fuel distribution, and communications at the same time. CISA and the GAO have both flagged that adversary nations have pre-positioned access inside American critical infrastructure networks — not to strike today, but to have the option ready during a future conflict.

If resolution stretches beyond two weeks, daily life changes fundamentally. You’re living in a regional disaster zone without the dramatic visual cues of a hurricane or earthquake. The pipes are still there, the wires are still there, the roads are still there — none of it works because the digital systems controlling it are compromised. Your day revolves around water procurement, food management, fuel conservation, and information gathering. Manual skills stop being a hobby and start being a genuine advantage: navigating without GPS, cooking without electricity, purifying water without municipal treatment, staying warm or cool without HVAC. Practical bushcraft knowledge earns its keep here. The people who thrive in an extended infrastructure failure aren’t the ones with the most stuff — they’re the ones with the most versatile skills.

Your Infrastructure Cyberattack Preparedness Checklist

Complete preparedness kit inventory

What should you actually be doing before anything happens? Ongoing habits matter more here than any single item you buy.

During — immediate response actions

• Top off your vehicle’s fuel tank immediately if stations are still operational. Don’t wait for confirmation of what’s happening.
• Fill every available container with tap water while pressure and treatment are still functional — bathtubs, pots, dedicated containers, WaterBOBs if you have one.
• Verify your cash supply is accessible and secure.
• Turn on your battery radio and tune to local AM/FM news and NOAA weather radio for actual information.
• Unplug sensitive electronics if power is fluctuating — grid instability can produce surges that fry equipment during cycling.
• Take stock of your food inventory and plan meals around perishables first: fridge, then freezer, then shelf-stable.
• Check on vulnerable neighbors — elderly, medically dependent, families with infants.
• Limit phone use to essential communication. Switch to airplane mode between calls and charge from a vehicle or solar charger.

After — recovery phase

• Don’t trust the water supply immediately after systems are reportedly restored. Wait for an official all-clear and consider flushing your home’s lines first.
• Replenish everything you used — fuel, water, cash, batteries, food. The first event proved your plan works. Reload it for the possibility of a second one.
• Write down what worked and what didn’t while it’s still fresh. What ran out first? What did you wish you’d had?
• Update your offline document cache if anything’s changed — insurance, prescriptions, account info.
• Fix your information gaps. If you struggled to know what was happening, that’s your cue to add a ham radio or set up a family check-in protocol.

What Most People Get Wrong

The number one mistake I run into when I talk to people about infrastructure cyberattack preparedness is assuming it’ll look like a movie. People picture explosions, instant blackouts, a clear villain on the news. The reality is far more mundane, and honestly more dangerous because of it. A cyberattack on infrastructure looks like a Tuesday that slowly gets weird. Your card gets declined. The gas station has a handwritten “NO GAS” sign taped to the pump. Your phone can’t load anything. There’s no siren telling you to activate your plan. The insidious part is that most people spend the critical first hours assuming everything’s fine and will get fixed shortly. By the time they realize it won’t, the easy window for topping off fuel and stocking up has already closed.

The second mistake I see constantly is over-relying on technology for the preparedness plan itself. I’ve met people whose entire emergency plan lives in a cloud notes app, whose important documents only exist in Google Drive, and whose whole communication plan depends on smartphones and cellular networks staying up. If the scenario you’re preparing for is the failure of digital infrastructure, your prep can’t depend on digital infrastructure to survive it. Print your plans. Write down phone numbers with an actual pen. Keep paper maps in the glove box — and while you’re at it, learn how to actually navigate with them.

The third mistake is thinking this is somebody else’s problem — that the government will handle it, that your city has redundancies, that hackers only go after big companies. The Oldsmar attack hit a water plant serving roughly 15,000 people in a small Florida city. Nobody’s too small to be a target, and nobody should be too complacent to prepare. If you haven’t started building your foundation yet, the beginner’s guide is a practical, no-nonsense place to start that covers the essentials without the tinfoil-hat noise.

Keep Reading

Scenarios

EMP and Solar Flare Preparedness: Protecting Your Life When the Grid Goes Down

The 1859 Carrington Event melted telegraph wires. A repeat today would knock out the modern grid for months. Here's what an EMP or solar flare actually does — and how to prepare for a world without electricity.

Scenarios

Volcanic Eruption Preparedness: When the Mountain Wakes Up

Mount St. Helens gave scientists 2 months of warning — yet 57 people still died. The 2022 Tonga eruption sent a shockwave around the planet twice. Here's what volcanic eruptions actually threaten, how far danger extends, and how to prepare whether you live near a volcano or not.

Scenarios

Tsunami Preparedness: What to Do When the Ocean Retreats

The 2004 Indian Ocean tsunami killed 227,000 people in 14 countries in under 8 hours. A 10-year-old girl's geography lesson saved 100 lives on a Thai beach. Here's what tsunamis actually look like — and the knowledge that makes the difference between life and death.