Cyberattack on Germany: What Happens When Power, Water and Logistics Fail

The Scenario: Day Zero

It's a Tuesday morning in November. Overnight, malicious code deployed months earlier activates simultaneously in multiple industrial control systems across Germany's power grid, water treatment infrastructure, and key logistics networks.

By 7 AM, several major regional power operators report anomalies. By 9 AM, rolling power failures begin affecting large urban areas. Emergency services switch to backup power. Mobile networks start deteriorating as cell towers exhaust battery reserves.

This is not a natural disaster. It is the result of a coordinated attack that has been planned for months.

---

Hour 0-6: The First Morning

What the public experiences:

• Power outages that don't follow the usual pattern (no visible damage, restoration updates delayed)
• ATMs offline, card payment terminals failing
• Supermarkets switching to cash-only or closing
• Petrol stations unable to pump (require electricity)
• Mobile networks becoming congested or failing in affected areas

What's actually happening:

• Emergency operations centers are overwhelmed trying to understand the scope
• Grid operators are manually attempting to isolate affected systems
• Cyber incident response teams from BSI are being deployed
• Law enforcement is trying to determine if this is an isolated incident or coordinated attack

What prepared households do: Nothing they weren't already doing. They have power (from planned backup), food, water. They listen to battery-powered radio for official information.

---

Day 1-3: The Critical Window

The first 72 hours determine the trajectory. If grid operators can restore power to most regions within 72 hours, the crisis is manageable. If systems remain compromised and widespread outages continue, cascading failures begin.

Water pressure: Most water distribution systems require electrical pumps. When grid power fails and backup power is exhausted (typically 24-72 hours), water pressure drops. Large cities may still have elevated storage tanks providing gravity-fed pressure for a few more days. Smaller municipalities may lose water pressure faster.

Food supply: Supermarkets have limited on-shelf inventory — typically 1-3 days of high-demand items. Without cold chain (refrigerated trucks, in-store refrigeration), perishable food spoils within 24-48 hours. Non-perishable goods remain available but are quickly depleted as people rush to buy.

Healthcare: Hospitals have generator backup — generally 72-96 hours of diesel. Beyond that, critical care patients face life-threatening situations. Dialysis centers, insulin refrigeration, home oxygen equipment — all dependent on power.

---

Day 4-7: Cascading Effects

If the attack is not neutralized within the first few days, secondary effects compound:

Communication breakdown: Without power to charge phones and with network infrastructure degraded, coordination becomes difficult. Information spreads by word of mouth and battery radio. Misinformation increases significantly.

Public behavior changes: Security incidents increase at food distribution points. Pharmacies are overwhelmed with medication requests. People who haven't prepared begin improvising with increasing desperation.

Critical supply chains: Fuel distribution for emergency services, heating fuel delivery, and food logistics all require functional grid infrastructure. The longer the outage, the harder logistics become.

---

What Actually Protects Citizens

This scenario is the reason standard emergency preparedness recommendations exist:

14-day food supply: Removes you from the demand surge at supermarkets entirely. You're not competing for limited shelf stock.

Water storage (14 days minimum): If water pressure fails, you have supply while restoration occurs.

Battery-powered radio: Your reliable information source when power is out and internet is unavailable.

Cash reserve: The financial infrastructure that works when card systems fail.

Medications (30-day supply): If pharmacies close or can't receive shipments, you're not in crisis.

Community network: Neighbors who share skills, resources, and information. The best-prepared households support those who aren't.

---

Germany's Actual Resilience

Germany's infrastructure is better protected than this scenario suggests it would end. The BSI's threat monitoring is sophisticated. Major operators have isolated operational technology networks. The grid has multiple redundancies.

The realistic scenario isn't "total collapse for weeks" — it's "significant regional disruption for days to 1-2 weeks." That's long enough that unprepared households face real hardship. It's short enough that 14-day preparation handles it comfortably.

The investment in preparation isn't about preparing for worst-case — it's about being resilient through realistic cases.

---

What Individual Citizens Can Do

Before a crisis:

1. Maintain 14-day food and water supply (the most impactful single action)
2. Have cash in small bills
3. Have a battery or hand-crank radio
4. Know your neighbors
5. Have 30-day medication supply for any regular medications

During a cyber-caused crisis:

1. Reduce consumption of perishables first (eat refrigerator/freezer before shelf-stable goods)
2. Follow official channels (NINA, public radio, not social media)
3. Don't contribute to runs on stores or fuel stations — you're prepared
4. Offer assistance to vulnerable neighbors who aren't

What not to do:

• Panic purchase (contributes to the problem)
• Spread unverified information
• Make major decisions based on social media rumors
• Drive anywhere unless necessary (keeps roads clear for emergency services)