Cyber Attacks on Power, Water and Hospitals: What Households Can Do

Quick answer: Cyber attacks on utilities and services are real, but the incidents so far have mostly disrupted one service for hours or days. Past attacks have cut power to about 225,000 customers in Ukraine, delayed hospital operations in London, and knocked out a mobile network, cash machines and card terminals for two days. Households can prepare in two ways: keep a few days of basic supplies (water, food, cash, a radio, a torch, medicines), and follow simple cyber hygiene such as updates, strong passwords and 2-step verification.

Why governments are talking about cyber attacks now

In October 2025, the UK’s National Cyber Security Centre (NCSC) said it had handled 429 incidents in the year to the end of August 2025. Of these, 204 were “nationally significant”, an average of about four a week. Eighteen were classed as highly significant.

Across the EU, the cyber security agency ENISA analysed 4,875 incidents between July 2024 and June 2025 in its Threat Landscape 2025 report. It found that threat groups increasingly reuse tools, share methods and work together.

In March 2025, the European Commission’s Preparedness Union Strategy named hybrid and cyber threats among the risks Europe must plan for. It also encouraged people to keep essential supplies for at least 72 hours. You can read more in our post on the EU 72-hour preparedness strategy.

None of this means an attack on your local services is likely tomorrow. It means officials want homes to cope calmly if one happens.

Real incidents, and what households noticed

These examples come from official advisories and reputable news reports. We only mention who was responsible where officials have said so.

Power: Ukraine, December 2015

On 23 December 2015, attackers broke into the systems of several Ukrainian power companies. About 225,000 customers lost power across three distribution areas, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The attackers also damaged equipment that engineers needed to restore supply. The US government later attributed the activity to Russian state cyber actors.

Water: US and Norway

In a joint advisory first issued in December 2023, CISA, the FBI, the US Environmental Protection Agency, the UK NCSC and others warned that cyber actors linked to Iran’s Islamic Revolutionary Guard Corps had targeted control devices used in water systems. At least 34 devices in the US water sector were compromised. Weak default passwords and devices left open to the internet were the main ways in.

In September 2024, Arkansas City in Kansas switched its water treatment plant to manual operation after a cyber incident. The city said the water stayed safe and service was not disrupted. This is a good example of how backup plans protect households.

In August 2025, Reuters reported that the head of Norway’s counter-intelligence service said Russian hackers had briefly taken control of a dam earlier that year.

Hospitals: London, June 2024

On 3 June 2024, a ransomware attack hit Synnovis, a pathology company serving Guy’s and St Thomas’ and King’s College hospitals. Operations were postponed, blood transfusions were disrupted, and staff went back to pen and paper. The NHS asked the public to donate O-negative and O-positive blood.

Phones and payments: Ukraine, December 2023

On 12 December 2023, a cyber attack hit Kyivstar, a mobile operator serving more than half of Ukraine’s population. Customers lost mobile signal and internet for about two days. The Record reported knock-on effects on some air raid sirens, banks, cash machines and card terminals. A hacker group claimed responsibility.

Shops and food: UK, spring 2025

In April 2025, attacks hit UK retailers including Marks & Spencer and the Co-op. M&S paused online orders, and some stores had empty shelves while stock systems were offline. The Co-op said some member data, including names and contact details, was accessed.

What these attacks mean for a household

Most attacks above disrupted one service for hours or days. The effects that reached homes were familiar ones: no power, slower healthcare, no mobile signal, card payments down, or gaps on shelves.

Service hit	What you might notice	What helps at home
Power	Lights, heating, fridge and router off	Torches, power banks, warm layers, fridge food plan
Water	Low pressure or a “do not drink” notice	Stored drinking water
Hospitals and labs	Postponed tests or operations	Spare supply of regular medicines, paper copy of prescriptions
Mobile network	No calls or data	Battery or wind-up radio, paper contact list, meeting point
Payments and banks	Cards and cash machines down	Some cash in small notes and coins
Shops and supply	Empty shelves for some items	A small stock of food you already eat

These are the same supplies that help in a storm or power cut. That is good news: one kit covers many risks.

Supplies: what official kit lists say

The UK government’s Be Ready campaign suggests keeping:

3 litres of drinking water per person per day
Food that keeps for 3 days
A battery or wind-up FM radio
A torch and spare batteries
A power bank
Cash, as a mix of notes and coins
A first aid kit and essential medicines
Copies of important documents

Our 72-hour emergency kit guide turns this into a shopping list. If anyone in your home relies on regular medicines, read our guide to medications in emergencies.

Cyber hygiene: protect your own accounts

You cannot defend a power station, but you can make your own devices and accounts much harder to break into. The UK NCSC and US CISA give very similar advice.

NCSC’s top tips:

Protect your email with a strong password you do not use anywhere else.
Install software and app updates.
Turn on 2-step verification (2SV).
Use a password manager.
Back up your important data.
Use three random words to make strong passwords.

CISA’s four steps: recognise and report phishing, use strong passwords, use multi-factor authentication and a password manager, and update your software.

If you think you have been affected, Ready.gov suggests:

Change your account passwords.
Disconnect a device you think is infected and have it checked.
Watch bank and card statements for payments you do not recognise.
Contact your bank if money may be at risk, and report the crime to the police (in the US, also to the FBI’s Internet Crime Complaint Center).

When a company you use announces a breach, be careful with emails and texts about it. Go to the company’s website yourself rather than clicking links in messages.

Checklist

Want to see how long your home could manage on its own? See how many days your household would last with our free calculator.

A calm, prepared household can ride out most disruptions like these. Follow updates from your national cyber agency and local authorities if services are disrupted.

Sources & further reading

Every fact in this post was checked against the sources listed above on 1 November 2026. Advice changes: always follow your local authorities.