Experts are sounding the alarm over a looming threat to American critical infrastructure, warning that a coordinated cyberattack could be more devastating than the September 11, 2001, terrorist attacks. This potential "cyber 9/11" scenario involves foreign adversaries using hidden malware to disrupt essential services like water and power, leading to cascading chaos across the nation.
Annie Fixler, a cyber expert at the Foundation for Defense of Democracies (FDD), highlighted the extreme vulnerability of major cities such as New York and Los Angeles to attacks on their water supplies, noting that faucets could run dry within hours. She emphasized that the failure of wastewater systems could render a city uninhabitable in a matter of hours. "Can you ship in enough bottles of water for a large city by road? Probably not," Fixler stated, underscoring the speed at which such a crisis could escalate.
Experts, including Fixler, point to China as a primary threat, suggesting Beijing is preparing to cripple U.S. infrastructure as a precursor to a potential military action against Taiwan. Research from FDD indicates that China could collaborate with hackers from Russia, Iran, and North Korea for such an assault. This aligns with documented incidents, such as a wave of cyber-physical attacks on water and wastewater utilities in at least a dozen states during July and August 2026. These attacks targeted control systems for pumps and valves, with Minnesota experiencing over 30 compromised municipal water systems, including a brief shutdown of Braham's entire water supply. U.S. intelligence agencies suspect Iran's involvement in these attacks as retaliation for ongoing conflicts with Washington.
China has also been implicated in covertly infecting U.S. electricity, water, and transport networks through a hacking group known as Volt Typhoon. This group reportedly uses stealthy tactics, stealing passwords to impersonate network managers, making them difficult to detect with traditional security systems. Microsoft and the Cybersecurity and Infrastructure Security Agency (CISA) have identified Volt Typhoon, raising concerns within the national security establishment.
Kevin Mandia, a leading cybersecurity expert, warned that Volt Typhoon's hackers are so stealthy that many targets may not even realize they are compromised. Analysts fear Beijing could trigger these hidden vulnerabilities in a synchronized "Everything, Everywhere, All at Once" assault designed to paralyze the nation. Beijing has denied all accusations, dismissing them as politically motivated.
The consequences of such attacks could be severe. Within days, blackouts could cripple communications, payment systems, and hospitals. Stores could face shortages of food and medicine, leading to a scenario of failing infrastructure and desperate communities. Jon Wellinghoff, former chairman of the Federal Energy Regulatory Commission, warned that disabling just nine critical high-voltage substations could trigger a nationwide blackout lasting up to 18 months, potentially leading to societal collapse. He noted that identifying such targets is disturbingly simple.
Physical sabotage also poses a significant threat. In 2022, attackers blasted two Duke Energy substations in North Carolina with high-powered rifles, causing a multi-day blackout for 45,000 residents. A 2013 incident saw snipers fire over 100 rounds into California's Metcalf substation, destroying transformers and narrowly averting a Silicon Valley blackout. These incidents highlight the fragility of the power grid, which Wellinghoff described as a domino-like system easily toppled.
Jen Easterly, former head of CISA, stated that the U.S. remains unprepared for the scale of potential cyber threats. For decades, technology vendors have prioritized speed and convenience over cybersecurity, resulting in insecure code that is vulnerable to manipulation. This creates a dangerous "soft underbelly" for foreign adversaries.
America's infrastructure is particularly vulnerable due to its fragmented water districts and local power grids. Many of the nearly 150,000 public water systems are small, operate on limited budgets, and are ill-equipped to defend against sophisticated state-sponsored hackers. Fixler noted that while water and power executives are aware of these vulnerabilities, decades of underfunding upgrades have left them exposed. She also expressed concern that the public has become desensitized to warnings, dismissing genuine dangers.
The threat is amplified by artificial intelligence, which is turbocharging the capabilities of malicious actors. A coalition of technology companies issued an urgent warning in August 2026 that a narrow window remains to fortify global networks against AI-driven threats before they outpace human defenses. The Justice Department and FBI have intensified actions against foreign state-sponsored hacking networks, including targeting Chinese groups like QTFY, accused of digital raids on NASA and the Federal Reserve.
While the nature of the threat differs significantly from the 9/11 attacks, the parallels lie in the exploitation of overlooked vulnerabilities. Al Qaeda exploited the vulnerability of civilian aircraft, while current adversaries are targeting the nation's water and power systems. Fixler suggests that simple, foundational security measures, such as eliminating default passwords and securing internet-connected systems, could significantly reduce America's exposure to a "cyber 9/11."