Attacks on grid infrastructure in 4 states raise alarm

By Miranda Willson | 12/09/2022 07:01 AM EST

Security experts said it’s too soon to tell whether recent incidents were related, but they pointed to a need for the energy industry to be vigilant and prepared.

Workers and substation equipment are seen Monday in Moore County, N.C., where a weekend attack on critical infrastructure caused a power outage to tens of thousands of customers.

Workers and substation equipment are seen Monday in Moore County, N.C., where a weekend attack on critical infrastructure caused a power outage to tens of thousands of customers. Karl B DeBlaker/AP Photo

Shootings at two electric substations in North Carolina last weekend are among the numerous threats posed to U.S. electric infrastructure since mid-October, raising questions about whether such incidents are on the rise.

Concerns grew further after Duke Energy Corp. reported gunfire near its Wateree Hydro station in Ridgeway, S.C., on Wednesday — several days after gunshots severely damaged two substations the company operates in Moore County, N.C. (Energywire, Dec. 7).

The incidents in the Carolinas followed attacks at six substations in Oregon and Washington in October and November. Local news outlets reported on those events this week. Grid security experts said it’s too early to tell whether the incidents were related or unusual in number, but said they showcase a need for the energy industry to be vigilant and prepared.


“It remains troubling and highlights how vulnerable is our critical infrastructure,” Richard Mroz, a senior adviser at the grid security advocacy group Protect Our Power, said in an email, referring to the string of incidents.

While vandalism and theft of materials like copper at substations are common, “damage due to firearms is rare,” said Ross Johnson, a security and intelligence specialist at Bridgehead Security Consulting Inc. There are more than 55,000 substations nationwide, which are considered a key component of the power grid.

“It’s a signal-to-noise problem: substation incidents are common, gunfire less so but not unheard of, and until arrests are made we are unlikely to know the motivation,” Johnson said in an email.

The incidents come at a time when energy regulators and others say that threats to the power system — be they physical or cyber in nature — are becoming more serious and common.

In particular, threats to power grid infrastructure and elements of the electricity supply chain are increasing “not only in complexity, but in volume,” said Manny Cancel, CEO at the North American Electric Reliability Corp.’s Electricity Information Sharing and Analysis Center.

“It’s the most complex threat landscape I’ve seen in my experience, and I’ve been in this industry for a long time,” Cancel said this week during a meeting with the Federal Energy Regulatory Commission on supply chain issues.

As of Thursday, law enforcement officials had not confirmed motives in any of the recent attacks, nor have suspects been identified. While some of the incidents involved gunfire, it’s unclear if guns were involved in all of the events.

The Wednesday incident at the South Carolina hydroelectric plant did not cause any reported outages or known property damage, said Duke Energy spokesperson Logan Kureczka.

Duke said Thursday that it had restored power for all customers in Moore County affected by last weekend’s substation attacks, which initially left 45,000 homes and businesses in North Carolina in the dark.

“The complexity of repairs required was extensive, and we appreciate our customers’ patience and understanding during a situation we know has been challenging for them, their families and the community as a whole,” Jason Hollifield, Duke’s general manager of emergency preparedness, said in a statement.

Oregon and Washington

While the incident in North Carolina received widespread attention, it was preceded by substation attacks in Washington and Oregon.

Late last month, two electric substations near the Portland, Ore., suburb of Clackamas were targeted in what utilities described as deliberate attacks. The substations are operated separately by the Bonneville Power Administration and Portland General Electric, and it’s unclear if they were attacked on the same day or if the events were connected.

The attack on the Bonneville Power Administration substation occurred in the early morning hours of Thanksgiving, during which time utility operators discovered “a cut perimeter fence and damaged equipment inside,” said spokesperson Kevin Wingert. No power outages occurred because of the event.

At a Portland General Electric substation, an incident “briefly impacted” power service for the utility’s customers, said PGE spokesperson Allison Dobscha. The FBI is investigating the attack in Moore County, N.C., and utility representatives said that's also true with the Bonneville and PGE incidents.

“Our teams have assessed the damage and begun repair to the impacted facility,” Dobscha said in an email.

Both Dobscha and Wingert declined to say what, if any, weapons were used in the attacks, citing security concerns and ongoing law enforcement investigations.

At least four substations in Washington have also been vandalized or targeted.

In mid-November, two utility substations located near Woodland, Wash., operated by the Cowlitz County Public Utility District experienced “vandalism,” according to utility district spokesperson Alice Dietz. They resulted in “brief outages” and the facilities have since been repaired, Dietz said.

“We don’t have any further comment as it is continuing to be an active investigation,” she said, adding that the incidents were “unusual.”

Also last month, two substations operated by Puget Sound Energy, an electric and natural gas utility based in Bellevue, Wash., experienced “vandalism,” according to spokesperson Gerald Tracy.

“There is no indication that these vandalism attempts indicate a greater risk to our operations and we have extensive measures to monitor, protect and minimize the risk to our equipment and infrastructure,” Tracy said in a statement, adding that the events appeared to be unrelated to other attacks on substations.

Another substation near Maysville, N.C., meanwhile, fell offline after it was damaged in an incident of vandalism, according to the Carteret-Craven Electric Cooperative, which operates the substation. It was unclear as of Thursday whether the substation had come back online.

Vandals managed to damage the substation’s transformers — which help in the process of moving electric current from generators to homes and businesses — and cause coolant oil to leak, the cooperative said in a statement on its website.

Over 12,000 members of the Carteret-Craven co-op lost power for approximately two hours when the incident occurred on Nov. 11, the statement said.

While attacks on power system infrastructure are a reminder of the vulnerability of the grid, widespread, planned events are still relatively rare, said Tony Clark, a former FERC commissioner who is now a senior adviser at Wilkinson Barker Knauer LLP.

“The more coordinated type attacks … where it seems like there’s something nefarious or coordinated with a big impact, that seems to be less common,” Clark said. “But I don’t know if I can say whether there’s been a trend one way or another.”