03 The Damage Is Not Always a Blackout

The most dangerous attack can be the one that stops just enough.

When people imagine a cyberattack on energy, they picture a city going dark. That picture makes the problem feel rare and distant.

The Polish plant tells a quieter, more useful story. The turbine stopped. The water-treatment system stopped. Cogeneration, the plant's whole reason for existing, was interrupted. And the controllers were locked with a password the operators did not have, so they could not simply switch them back on.

The crew started recovering while the attacker was still inside. Picture that morning. You are restoring a plant you can no longer fully trust, against someone who may still be watching.

Then the attacker erased the trail. Routers were reset. Firewall logs were wiped. The controller used as a doorway was damaged. Investigators started with less evidence than they needed.

Elsewhere in the same campaign, the damage was worse. At about 30 wind and solar sites and a larger heat-and-power plant, equipment was destroyed beyond repair.

What the cost really looks like. It is the hours of not knowing. It is crews sent to check every cabinet. It is the choice between restarting fast and restarting safely. It is the regulator's questions, and the ones from the public.

Resilience in this world comes down to one thing: how fast you know what is happening, and how precisely you can act on it.