A Thousand Cuts

Many small intrusions and failures adding up to infrastructure risk.

Check Point counted an average of 1,162 cyberattacks on US utilities in 2024 through August, against 689 in 2023. More than 70% of US water systems the EPA inspected failed basic cybersecurity requirements.

Cyberattacks on US utilities: 2023 689; 2024, through August 1,162. Secondary source reporting Check Point data CYBERATTACKS ON US UTILITIES 2023 689 2024, through August 1,162 AVERAGE, CHECK POINT SECONDARY SOURCE REPORTING CHECK POINT DATA
Water systems inspected in violation
70%+
EPA cyber enforcement actions since 2020
100+
Internet-exposed Unitronics PLCs
1,800+
Data center load dropped at once
~1,500 MW

Evidence

No single event, but steady pre-positioning and common-mode failures

Documented cases: A Thousand Cuts
DateCaseCountryWhat happenedSource
Feb 7, 2024Volt Typhoon advisoryUnited StatesPRC actors held footholds in infrastructure networks for at least five yearsSource
May 20, 2024EPA drinking water enforcement alertUnited StatesOver 70% of inspected systems out of complianceSource
Oct 2024American Water breachUnited StatesLargest US water utility took billing offline; treatment unaffectedSource
Jan 8, 2025NERC review of Virginia load lossUnited StatesCommon-mode control failures dropped about 1,500 MW of data center load at onceSource
Oct 19, 2025National Time Service Center allegationChinaMSS accuses the NSA of a 2022 to 2024 campaign; unconfirmedSource

Registry

No registry incident turns on cumulative infrastructure harm yet

The cases above are documented, but none yet meets the registry bar of a named developer, a failed control and a known finder.

Exposure

Three of 17 agent types rate very significant or critical on connectivity surface

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
DronesConnectivity surfaceVery significant
Fleets and swarmsConnectivity surfaceVery significant
Smart home assistantsConnectivity surfaceVery significant

Controls that bound it

Rules

Water and grid rules exist but enforcement depends on inspection

Rules that address cumulative infrastructure harm
RuleJurisdictionWhat it requiresStatus
Safe Drinking Water Act Section 1433USRisk and resilience assessments with cyber elementsEnforcement alert May 2024
NERC inverter-based resource standardsNorth AmericaBring inverter-based resources into reliability standards2025-26 rollout
CII Security Protection RegulationsChinaSecurity duties for infrastructure operatorsIn force since 2021

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Risks Hub
Datasets
ai_risk_evidence.csv (5 rows); registry incidents (0 linked); ai_attack_surface.csv
Key sources
Volt Typhoon advisory
EPA drinking water enforcement alert
American Water breach
NERC review of Virginia load loss
National Time Service Center allegation
Last verified
October 2026