How to Prepare for a Cyberattack: Water, Power, Payments, Phones

A cyberattack on infrastructure rarely looks like the movies. The grid does not go dark coast to coast, and no one needs a bunker. The real pattern is narrower: one utility loses its controls, one payment network goes down, one pipeline stops moving fuel while engineers work the problem. Households that treat it as an outage with a few extra twists ride it out. Households that wait for certainty join the line at the store.

July 2026 showed the shape. A coordinated cyberattack hit operational technology at more than 30 Minnesota community water systems over two days, according to Minnesota IT Services. In Braham, a town of about 1,700, attackers shut off the controls for the well and treatment plant, and the city asked residents to conserve water for a few hours. State officials said water quality was not affected and no community needed residents to change how they used drinking water. The FBI and EPA later warned that tampering with internet-exposed controllers had been reported at utilities in at least seven states since late July, with operational effects that included loss of pressure. Most affected systems fell back to manual operation and kept water flowing.

Quick answer: Treat a cyberattack as an outage with two extra twists: money and records. Keep two weeks of water and food, $100–$200 in small bills, offline copies of your key documents, and a battery radio for official updates. If your utility asks you to conserve or boil water, do it. If card readers fail, cash works. Do not panic-buy fuel, and do not pass along reports you cannot verify.

What actually breaks

Water and power controls. Treatment plants, wells, and substations run on remote monitoring and control. When attackers lock utilities out of those systems, the recovery path is manual operation, which is slower and narrower. The FBI and EPA's July 2026 advisory recommends exactly that fallback: practice running the system by hand. For a household, the visible effect is a conserve-water request or a pressure drop, not a poisoned supply. If pressure drops or a boil-water notice lands, treat every tap as suspect until the utility clears it, using the same steps as when the water goes off.

Payments and records. The February 2024 ransomware attack on Change Healthcare, which the company says affected about 190 million people, disrupted insurance claims and pharmacy payments across the country for weeks. Banks and card networks are more resilient than that, but an outage at a payment processor can still leave terminals down. A few days of cash covers fuel, groceries, and a pharmacy run; paper copies of prescriptions and account numbers cover the rest.

Fuel and logistics. In May 2021, ransomware shut down the Colonial Pipeline, a 5,500-mile system that carries about 45 percent of the East Coast's fuel, for six days, according to the U.S. Department of Energy. Keep the tank above half and skip the run on the pumps.

What usually does not happen. A nationwide grid blackout that lasts weeks, or an attack that erases your bank account, is not the realistic case. Local, days-long disruption is, and the prep below is the same either way.

The prep that pays off no matter the cause

• Water first. Two weeks at a gallon per person per day is FEMA's baseline, and the food and water storage guide covers rotation. If pressure drops, fill the bathtub and every container early: pumps and towers drain before the tap does.
• Cash. $100–$200 in small bills covers a few days of fuel and food when card readers fail; the emergency fund guide has the storage setup.
• Information. A battery or hand-crank NOAA radio like the Midland ER310 Emergency Radio (about $80) receives official alerts with no internet and no cell network. Your utility's outage map and local emergency management page are the other two channels worth bookmarking now.
• Offline records. Scan IDs, insurance policies, and account pages to a drive like the Samsung BAR Plus 128GB USB 3.1 Flash Drive (about $40) and keep it with your documents; the grab-and-go document binder has the full list.
• Network gear. A standby UPS like the CyberPower ST425 Standby UPS Battery Backup (about $60) rides your router and modem through brownouts and short outages, so a grid stumble does not take the connection you still have.
• A comms plan. One out-of-area contact and a text-first rule, because calls congest faster than texts: family emergency communication plan.

The first day of an incident

Follow the utility and your local emergency management office, not social media. Officials will say what changed: a conserve-water request, a boil notice, a restoration timeline. Conserve as asked. Braham's outage was measured in hours partly because residents cut use early.

Keep your own accounts clean while attention is elsewhere. Ready.gov's guidance: check card and bank statements, change passwords if anything looks off, and report incidents to the FBI's Internet Crime Complaint Center and the FTC. Phishing spikes around big incidents, so treat urgent "security alerts" that ask you to click or call as hostile until proven otherwise.

What not to do

• Do not panic-buy fuel or water. Panic buying emptied stations across the Southeast within days of the Colonial shutdown, before supply was the real problem.
• Do not forward unverified reports. During the Minnesota attack, the confirmed facts came from the state and the FBI, not from screenshots.
• Do not trust the urgency. Ready.gov notes the government will not call, text, or message you about owing money, and no company will call to take control of your computer to "fix" it.
• Do not wait to fill water. Containers filled before the notice beat a queue at the store after it.

Prep it this week

Fill the water shelf, set aside small bills, scan the documents, and charge the radio. That is the whole list. For the wider frame, the conflict preparedness guide covers the durable household baseline for conflict-driven shocks, and the power outage survival guide covers outage mechanics in depth.

Sources: Ready.gov cybersecurity guidance; FBI and EPA public service announcement on water-sector controller attacks (July 2026); Minnesota IT Services incident statement (July 28, 2026) and AP reporting; U.S. Department of Energy Colonial Pipeline cyber incident record; Change Healthcare breach notification.