Prepare for Six Months in the Dark

For years the official line has been the same: the grid is resilient, the lights will stay on, and the government has a plan.

Then you go read what the government actually wrote when it thought nobody outside the Beltway was paying attention. According to Google AI, the government has never issued a warning… BULLSHIT!

In December 2018, the President’s National Infrastructure Advisory Council — a body that reports through the Department of Homeland Security — published a 94-page study called Surviving a Catastrophic Power Outage. It wasn’t a blog post. It wasn’t a prepper podcast. It was DHS-adjacent, White House-tasked, and written after interviews with dozens of senior officials and industry leaders.

And its finding was this:

The nation’s plans, response resources, and coordination strategies would be outmatched.

Not strained. Not tested. Outmatched.

The council recommended the country start planning around an outage lasting “at least 2 months, but more likely 6 months or more” — driven by physical destruction of equipment like transformers and transmission lines, or by damage severe enough that there simply aren’t enough people or parts to fix it.

Six months. From the government’s own advisory council.

That report is still online. Most Americans have never heard of it.

The Two-Week Lie

Here’s the part that should make your jaw tighten.

The same report noted that the standing federal guidance was for households to keep about 14 days of supplies on hand.

Read those two numbers back to back.

The government’s own experts said plan for a six-month outage. The government’s own public guidance said stock two weeks.

Nobody ever reconciled those numbers. Nobody ever went on television and said, “We were wrong, go stock six months.” The report was published, filed, cited in a handful of trade journals, and left to rot.

That’s not a conspiracy. It’s worse. It’s bureaucratic cowardice.

Telling 340 million people that the federal government cannot restore power for half a year is a career-ending sentence in Washington. So the sentence never got said. The study just sat there — a loaded gun on the table nobody wanted to pick up.

We picked it up. We’ve been carrying it since 2018. And in the years since, the case has only gotten stronger.

Congress Has Been Holding Hearings About This — Quietly

If you think the 2018 report was a one-off, you haven’t been watching the hearing schedule.

December 2, 2025. The House Energy and Commerce Subcommittee on Energy held a hearing titled Securing America’s Energy Infrastructure: Addressing Cyber and Physical Threats to the Grid. Chairman Bob Latta opened it by warning that “Incapacitating the grid with cyber or physical attacks will have widespread, devastating impacts” to national security, the economy, and public health.

January 13, 2026. The same subcommittee was back at it — Protecting America’s Energy Infrastructure in Today’s Cyber and Physical Threat Landscape — with a stack of bills attached, including the Energy Threat Analysis Center Act and the Rural and Municipal Utility Cybersecurity Act.

March 25, 2026. The Senate Energy and Natural Resources Committee convened on grid reliability as demand explodes and resources lag.

Three hearings. Four months. Zero national news coverage that penetrated past page eleven.

At the December hearing, Congressman Troy Balderson pointed at the U.S.-China Economic and Security Review Commission’s 2025 report to Congress and noted the finding that “Chinese components in the U.S. grid creates risks for cyber espionage and sabotage.”

Foreign hardware. Inside the machine that runs your water treatment plant, your hospital, your gas pumps, your refrigerator.

Congress knows. Congress has known. They hold the hearings, they issue the statements, they go to lunch.

Who’s Already Inside

In February 2024, CISA, the NSA, and the FBI — joined by intelligence agencies from four allied nations — published joint advisory AA24-038A. Read it once and you won’t sleep the same.

The advisory confirmed that a Chinese state-sponsored group tracked as Volt Typhoon had compromised the networks of American critical infrastructure organizations. Communications. Energy. Transportation. Water and wastewater. In the continental U.S. and in its territories.

The purpose wasn’t theft. The agencies wrote that the actors were “pre-positioning themselves on IT networks to enable the disruption of OT functions” — OT meaning operational technology, meaning the systems that physically open and close breakers.

And the kicker: investigators found evidence of Volt Typhoon holding access inside some victim environments for at least five years without being caught.

Five years. Sitting there. Doing nothing. Waiting.

That’s not espionage. Espionage steals something and leaves. This is a hand on a switch that hasn’t been thrown yet.

Fast forward to March 18, 2026, when the Office of the Director of National Intelligence released the 2026 Annual Threat Assessment. The intelligence community’s language on cyber was clinical and terrifying: China, Russia, Iran, North Korea, and non-state ransomware groups will keep working to compromise U.S. networks and critical infrastructure to gather intelligence, for money, and to “create options for future disruption.”

Options for future disruption.

That is the U.S. government, in an unclassified public document, telling you that foreign powers are building the ability to turn your lights off at a time of their choosing.

At the December hearing, E-ISAC chief Michael Ball laid out the roster in writing: China’s Salt Typhoon and Volt Typhoon campaigns as the largest and most dynamic threats. Russia refining espionage and attack capabilities, currently aimed mostly at Ukraine and Europe — but with tactics that transfer. Iran monitored for retaliation. And North Korea running thousands of fake IT workers using deepfakes and AI personas to land remote engineering jobs at North American companies — jobs that come with administrative network access.

They’re not knocking on the door. Some of them already have a badge and a payroll number.

The Physical Side: 3,500 Incidents and Climbing

Cyber gets the headlines. The blunt-force stuff gets the results.

NERC’s E-ISAC year-end reporting counted more than 3,500 physical security incidents against the North American grid in 2025 — up from about 2,800 in its 2023 report. Roughly 3 percent actually disrupted electricity.

Three percent sounds small until you do the multiplication. Three percent of 3,500 is over a hundred events a year where somebody attacked a piece of the grid and the power went out.

Michael Coe of the American Public Power Association put the decade-long trend in one word: a “tenfold” increase in reported physical attacks.

The greatest hits are a matter of public record:

• Metcalf, California, April 2013. Snipers opened fire on a PG&E substation and damaged 17 transformers in under 20 minutes. Nobody was ever arrested.
• Moore County, North Carolina, December 2022. Gunfire into two substations. Roughly 45,000 customers in the dark for days, in December.
• Baltimore, February 2023. Federal agents disrupted a plot by two extremists to shoot up five substations ringing the city.
• Nashville, November 2024. A man arrested for attempting to attack a substation with a drone carrying C4 he’d tried to buy from undercover agents.
• San Jose, December 2025. An engineer sentenced to 10 years for bombing transformers in 2022 and 2023.

And it isn’t just here. Berlin took an arson attack on January 3, 2026 that blacked out 45,000 households for five days, following a September 2025 pylon arson that hit 50,000.

In his written testimony, Ball flagged something that should end the “nobody would actually do this” argument forever: during protests in Los Angeles, online users were naming specific targets and tactics — including a specific caliber of firearm to use against transformers, and drone bombing a substation.

The playbook is public now. It’s being workshopped in group chats.

The GridEx Scenario Nobody Wants to Talk About

Every two years the E-ISAC runs GridEx, the largest grid security exercise in North America. The eighth one ran November 18–20, 2025, with the after-action report released March 2, 2026.

The scenario: a fictional country called Beryllia, hosting the “World Chalice Games” during a brutal heat wave, gets hit by a coordinated campaign of vandalism, ballistic attacks, and drone strikes that cripples its grid.

Read that again and note the timing. The scenario was inspired by the 2026 World Cup and the 2028 Los Angeles Olympics.

The people who defend the grid for a living spent three days rehearsing a drone-and-rifle attack on a country hosting a mega-event during a heat wave — in the same window America is hosting exactly that.

They’re not war-gaming this because they’re bored.

Why “Just Fix It” Isn’t a Plan: The Transformer Issue

Here’s the issue that turns a bad week into a bad year.

Large power transformers are custom-built, house-sized, and largely imported. As of Wood Mackenzie’s Q2 2025 survey, standard power transformers were averaging 128 weeks from order to delivery. Generator step-up units: 144 weeks. Some orders stretch to four years. The CEO of Hitachi Energy — the largest transformer maker on the planet — told S&P Global in January 2026 that waits on large units still run up to 40 months.

Prices are up roughly 77 percent since 2019. Domestic manufacturing covers only about 20 percent of U.S. power transformer needs. Analysts project a 30 percent shortfall in power transformers against demand.

You cannot Amazon Prime a 400-ton transformer.

Now layer on NERC’s 2025 Long-Term Reliability Assessment, released January 29, 2026. Summer peak demand is projected to grow by 224 GW over ten years — 69 percent higher than the prior year’s forecast. Winter growth: about 245 GW. NERC flatly stated the compound growth rates are the “highest since NERC’s tracking started in 1995.”

And 13 of 23 assessment areas across North America now face elevated or high resource adequacy risk within five years. MISO. PJM. ERCOT. Chunks of the West.

So: record demand, thermal plants retiring, replacement parts on a four-year backorder, and adversaries pre-positioned inside the control networks.

That’s not a grid. That’s a house of cards with a fan pointed at it.

The Truth — Because You Deserve It

We’re not going to run the same fear-porn play everyone else runs. Here’s the other side, straight.

Michael Ball told Congress in December that the E-ISAC is “not aware of any specific, credible and imminent cyber or physical security threats” to the North American grid. He also confirmed that to date, there has never been a loss of load in North America attributed to a cyberattack. Not once.

The consulting firm Grid Strategies published a March 2026 analysis arguing that “NERC’s 2025 Long-Term Reliability Assessment is too pessimistic” — that it overestimates how much data center load actually connects and underestimates generation and interregional power flows.

And 97 percent of those 3,500 physical incidents caused no outage at all. Most are copper theft and vandalism, not sabotage.

All true. All worth knowing.

But notice what none of it says. None of it says the six-month scenario is impossible. None of it says the transformers will arrive faster. None of it says Volt Typhoon left. The argument isn’t whether the vulnerability exists — everyone from CISA to NERC to the DNI agrees it does. The argument is only about the odds.

And you don’t get to negotiate the odds. You only get to decide what happens to your family on the day the coin lands wrong.

Meanwhile the Cybersecurity Information Sharing Act of 2015 — the law that lets utilities share threat data with the government without getting sued — expired on September 30, 2025 and has been limping along on short-term extensions ever since. That’s the state of the defense.

What You Actually Do About It

The government told you six months in 2018 and then changed the subject. Fine. Do the math yourself and start moving.

Water first, and it’s not close. You die in three days without it, and municipal water is 100 percent dependent on electricity for pumping and treatment. Start here: Emergency Water Storage: Storing Water for Long-Term Preparedness.

Food that survives storage, not food that looks good on a shelf. Most grocery stores run on roughly a three-day inventory. Read Long-Term Food Storage: What Actually Lasts 25 Years and 60+ Long-Term Survival Foods You Can Buy at the Grocery Store before you spend a dollar.

Power you own. Not a wish — hardware. Cheap Off-Grid Power: Real Solar Setups Under $1,000 is where to start if you’ve got a budget. If you want the full field, see The Best Emergency Solar Generators & Power Packs.

Understand the actual threat mechanics. Power Grid Threats: EMPs, Terror Attacks and Grid Failures and EMP Preparedness: Preparing for an Electromagnetic Pulse Attack go deeper on the failure modes.

Communications, because the phone is dead in hour one. Communication Infrastructure: Preparing for Chaos.

Information without a signal. When the internet is gone and the AI slop is gone with it, what’s left is what you saved: Offline Knowledge Hubs: Building Your Own Digital Survival Library.

Starting from zero? What Preparedness Items Should You Stockpile? is the on-ramp.

Read It Yourself. Don’t Take Our Word For It.

Every claim above is sourced. Go look:

Somewhere in a substation yard tonight there’s a transformer with a four-year lead time, a chain-link fence, and a padlock from 1987.

Nobody is coming to guard it.

The grid doesn’t owe you a warning. It already gave you one, in 2018, on government letterhead — and you’re one of the few people who ever read it.

Now go fill the water barrels.