Yes, cyberattacks have caused real power outages. The best documented case is Ukraine in December 2015, when remote intruders cut power to about 225,000 customers. That is a regional outage with a recovery, not a continent going dark. The record supports concern and planning, not panic.
What the record shows
On 23 December 2015, three Ukrainian regional distribution companies had unscheduled outages. CISA's alert says the intrusions at the three companies happened within 30 minutes of each other and were likely preceded by extensive reconnaissance. Operators remotely opened breakers using remote administration tools or ICS client software over VPN connections.
The companies believed the attackers had obtained legitimate credentials earlier. Wiper malware then damaged systems, and some substation devices were disabled by corrupting their firmware. Power was restored, though the affected companies kept operating under constrained conditions for a time.
What the record does not show
The same alert does not describe a nationwide blackout, and it does not say the attack was easy to repeat. It describes a prepared, multi-stage operation against specific organizations. Attribution was added later: the US government attributes the campaign to Russian state actors.
That matters when you read a headline that says a hack "could take down the grid." The grid is not one system. It is many utilities, with different equipment, operators and network designs. A technique that works on one distribution company may not work on the next.
Why the damage is usually bounded
A few things limit scale. Operators can often switch to manual control, because breakers and substations can be run by people on site. Attackers need deep knowledge of each target. And the controls CISA recommends are well understood: isolate control networks from the internet, limit and time-box remote access, use strong multi-factor authentication, and keep an asset inventory.
None of this means the risk is zero. CISA and partners have also warned that state-sponsored actors have pre-positioned themselves inside energy sector networks, which is covered in Volt Typhoon pre-positioning explained.
What a software team can take from this
If you build software that touches utilities, the lessons are mundane and useful.
- Treat remote access as the most dangerous feature in your product.
- Make vendor connections time-limited and operator-controlled.
- Log every remote operation so an operator can tell a person from an intruder.
- Test the manual fallback, not just the automated path.
How to weigh a new claim
When you read the next story, check three things. Does it cite an event, such as the Ukraine outage, or only a scenario? Does it say how many customers or sites were affected, and for how long? And does it mention that operators recovered? A fair account names the scale and the recovery. A weak one jumps from "a vulnerability exists" to "the lights go out everywhere".
It also helps to separate IT from operational technology. Most intrusions start in ordinary office networks. The step that matters for power is reaching the systems that operate breakers and substations, and that step is where segmentation, remote access limits and manual fallback do their work.
Quick check
Has a cyberattack caused a power outage?
Yes. CISA documents the December 2015 attack on three Ukrainian distribution companies that caused outages affecting about 225,000 customers.
Does that mean a whole country can be blacked out at once?
The CISA alert describes a regional outage with recovery, not a national one. It does not support claims of an easy countrywide blackout.
Sources
- CISA alert IR-ALERT-H-16-056-01 on the Ukraine power grid attack
- CISA, NSA, FBI advisory AA24-038A on PRC state-sponsored actors
Last reviewed: 19 October 2026.
