Iranian hackers infiltrated a small New York dam in 2013 in a previously undisclosed incident, according to The Wall Street Journal. 
 
 ADVERTISEMENT 
 
 Investigators said that the hackers didn’t take control of the system, but were probing its defenses. The White House was alerted when officials initially believed the intrusion occurred at a much larger facility in Oregon. 
 
 The still-classified breach occurred amid a wave of Iranian hacks on U.S. banks and just three years after a computer worm believed to be built by the U.S. and Israel damaged nuclear infrastructure in Iran. 
 
 The incident fits a pattern openly described by U.S. officials who warn that hackers from Russia, Iran and China are testing U.S. critical infrastructure networks for vulnerabilities. 
 
 National Security Agency Director Michael Rogers told lawmakers last fall that China and “one or two” other countries would be able to shut down portions of critical U.S. infrastructure with a cyberattack. Researchers suspect Iran to be on that list. 
 
 In fiscal 2015, the Department of Homeland Security (DHS) responded to 295 hacking incidents related to industrial controls, up from 245 the year previous, the Journal reports. 
 
 If hackers moved from grid-mapping to a deliberate attack, the consequences could be devastating. A blackout across 15 states and Washington, D.C., could cost the economy hundreds of billions, raise mortality rates at hospitals and cut the nation’s water supply, according to a recent study. 
 
 Experts say utilities are unprepared to cope with the threat of such an attack. Much of the technology governing industrial systems is outdated and in many cases connected directly to at-risk office networks. 
 
 The U.S. has more than 57,000 industrial-control systems connected to the Internet. The DHS has issued repeated public warnings to utilities that their networks are at risk. 
 
 A top DHS official recently told energy firm executives at a conference that ISIS “is beginning to perpetrate cyberattacks.” 
 
 The incident in New York also raises questions about the murky set of guidelines surrounding cyberwarfare. 
 
 Experts say there are three distinct kinds of cyber intrusions: corporate espionage intended to financially benefit foreign companies, hacks intended to do damage to infrastructure and traditional intelligence-gathering efforts performed by nation states. 
 
 Lawmakers have called for clear standards governing the U.S. response to different incidents, in some cases pressing the intelligence community to create such guidelines. 
 
 “We don’t know what constitutes an act of war, what the appropriate response is, what the line is between crime and warfare,” Rep. Jim Himes (D-Conn.) said in a House Intelligence Committee hearing in September. ||||| ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 SAN JOSE, Calif. (AP) — Security researcher Brian Wallace was on the trail of hackers who had snatched a California university's housing files when he stumbled into a larger nightmare: Cyberattackers had opened a pathway into the networks running the United States power grid. 
 
 Digital clues pointed to Iranian hackers. And Wallace found that they had already taken passwords, as well as engineering drawings of dozens of power plants, at least one with the title "Mission Critical." The drawings were so detailed that experts say skilled attackers could have used them, along with other tools and malicious code, to knock out electricity flowing to millions of homes. 
 
 Wallace was astonished. But this breach, The Associated Press has found, was not unique. 
 
 About a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter. 
 
 The public almost never learns the details about these types of attacks — they're rarer but also more intricate and potentially dangerous than data theft. Information about the government's response to these hacks is often protected and sometimes classified; many are never even reported to the government. 
 
 These intrusions have not caused the kind of cascading blackouts that are feared by the intelligence community. But so many attackers have stowed away in the systems that run the U.S. electric grid that experts say they likely have the capability to strike at will. 
 
 And that's what worries Wallace and other cybersecurity experts most. 
 
 "If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier," said Robert M. Lee, a former U.S. Air Force cyberwarfare operations officer. "It will also help them stay quiet and stealthy inside." 
 
 In 2012 and 2013, in well-publicized attacks, Russian hackers successfully sent and received encrypted commands to U.S. public utilities and power generators; some private firms concluded this was an effort to position interlopers to act in the event of a political crisis. And the Department of Homeland Security announced about a year ago that a separate hacking campaign, believed by some private firms to have Russian origins, had injected software with malware that allowed the attackers to spy on U.S. energy companies. 
 
 "You want to be stealth," said Lillian Ablon, a cybersecurity expert at the RAND Corporation. "That's the ultimate power, because when you need to do something you are already in place." 
 
 The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking the plants up to the Internet over the last decade has given hackers new backdoors in. Distant wind farms, home solar panels, smart meters and other networked devices must be remotely monitored and controlled, which opens up the broader system to fresh points of attack. 
 
 Hundreds of contractors sell software and equipment to energy companies, and attackers have successfully used those outside companies as a way to get inside networks tied to the grid. 
 
 Attributing attacks is notoriously tricky. Neither U.S. officials nor cybersecurity experts would or could say if the Islamic Republic of Iran was involved in the attack Wallace discovered involving Calpine Corp., a power producer with 82 plants operating in 18 states and Canada. 
 
 Private firms have alleged other recent hacks of networks and machinery tied to the U.S. power grid were carried out by teams from within Russia and China, some with governmental support. 
 
 Even the Islamic State group is trying to hack American power companies, a top Homeland Security official told industry executives in October. 
 
 Homeland Security spokesman SY Lee said that his agency is coordinating efforts to strengthen grid cybersecurity nationwide and to raise awareness about evolving threats to the electric sector through industry trainings and risk assessments. As Deputy Secretary Alejandro Mayorkas acknowledged in an interview, however, "we are not where we need to be" on cybersecurity. 
 
 That's partly because the grid is largely privately owned and has entire sections that fall outside federal regulation, which experts argue leaves the industry poorly defended against a growing universe of hackers seeking to access its networks. 
 
 As Deputy Energy Secretary Elizabeth Sherwood Randall said in a speech earlier this year, "If we don't protect the energy sector, we are putting every other sector of the economy in peril." 
 
 ___ 
 
 THE CALPINE BREACH 
 
 The AP looked at the vulnerability of the energy grid as part of a yearlong, AP-Associated Press Media Editors examination of the state of the nation's infrastructure. AP conducted more than 120 interviews and examined dozens of sets of data, government reports and private analyses to gauge whether the industry is prepared to defend against cyberattacks. 
 
 The attack involving Calpine is particularly disturbing because the cyberspies grabbed so much, according to interviews and previously unreported documents. 
 
 Cybersecurity experts say the breach began at least as far back as August 2013, and could still be going on today. 
 
 Calpine spokesman Brett Kerr said the company's information was stolen from a contractor that does business with Calpine. He said the stolen diagrams and passwords were old — some diagrams dated to 2002 — and presented no threat, though some outside experts disagree. 
 
 Kerr would not say whether the configuration of the power plants' operations networks — also valuable information — remained the same as when the intrusion occurred, or whether it was possible the attackers still had a foothold. 
 
 According to the AP investigation, the hackers got: 
 
 —User names and passwords that could be used to connect remotely to Calpine's networks, which were being maintained by a data security company. Even if some of the information was outdated, experts say skilled hackers could have found a way to update the passwords and slip past firewalls to get into the operations network. Eventually, they say, the intruders could shut down generating stations, foul communications networks and possibly cause a blackout near the plants. 
 
 —Detailed engineering drawings of networks and power stations from New York to California — 71 in all — showing the precise location of devices that communicate with gas turbines, boilers and other crucial equipment attackers would need to hack specific plants. 
 
 —Additional diagrams showing how those local plants transmit information back to the company's virtual cloud, knowledge attackers could use to mask their activity. For example, one map shows how information flows from the Agnews power plant in San Jose, California, near the San Francisco 49ers football stadium, to the company headquarters in Houston. 
 
 Wallace first came across the breach while tracking a new strain of noxious software that had been used to steal student housing files at the University of California, Santa Barbara. 
 
 "I saw a mention in our logs that the attackers stored their malware in some FTP servers online," said Wallace, who had recently joined the Irvine, Calif.-based cybersecurity firm Cylance, Inc., fresh out of college. "It wasn't even my job to look into it, but I just thought there had to be something more there." 
 
 Wallace started digging. Soon, he found the FTP servers, typically used to transfer large numbers of files back and forth across the Internet, and the hackers' ill-gotten data — a tranche of more than 19,000 stolen files from thousands of computers across the world, including key documents from Calpine. 
 
 Before Wallace could dive into the files, his first priority was to track where the hackers would strike next — and try to stop them. 
 
 He started staying up nights, often jittery on Red Bull, to reverse-engineer malware. He waited to get pinged that the intruders were at it again. 
 
 Months later, Wallace got the alert: From Internet Protocol addresses in Tehran, the hackers had deployed TinyZbot, a Trojan horse-style of software that the attackers used to gain backdoor access to their targets, log their keystrokes and take screen shots of their information. The hacking group, he would find, included members in the Netherlands, Canada, and the United Kingdom. 
 
 The more he followed their trail, the more nervous Wallace got. According to Cylance, the intruders had launched digital offensives that netted information about Pakistan International Airlines, the Mexican oil giant Pemex, the Israel Institute of Technology and Navy Marine Corps Intranet, a legacy network of the U.S. military. None of the four responded to AP's request for comment. 
 
 Then he discovered evidence of the attackers' most terrifying heist — a folder containing dozens of engineers' diagrams of the Calpine power plants. 
 
 According to multiple sources, the drawings contained user names and passwords that an intruder would need to break through a firewall separating Calpine's communications and operations networks, then move around in the network where the turbines are controlled. The schematics also displayed the locations of devices inside the plants' process control networks that receive information from power-generating equipment. With those details, experts say skilled hackers could have penetrated the operations network and eventually shut down generating stations, possibly causing a blackout. 
 
 Cylance researchers said the intruders stored their stolen goods on seven unencrypted FTP servers requiring no authentication to access details about Calpine's plants. Jumbled in the folders was code that could be used to spread malware to other companies without being traced back to the attackers' computers, as well as handcrafted software designed to mask that the Internet Protocol addresses they were using were in Iran. 
 
 Circumstantial evidence such as snippets of Persian comments in the code helped investigators conclude that Iran was the source of the attacks. 
 
 Calpine didn't know its information had been compromised until it was informed by Cylance, Kerr said. 
 
 Iranian U.N. Mission spokesman Hamid Babaei did not return calls or address questions emailed by AP. 
 
 Cylance notified the FBI, which warned the U.S. energy sector in an unclassified bulletin last December that a group using Iran-based IP addresses had targeted the industry. 
 
 Whether there was any connection between the Iranian government and the individual hackers who Wallace traced — with the usernames parviz, Alireza, Kaj, Salman Ghazikhani and Bahman Mohebbi — is unclear. 
 
 ___ 
 
 A 'LUCRATIVE' TARGET 
 
 Cyberattacks designed to steal information are steadily growing in scope and frequency; there have been high-profile hacks of Target, eBay and federal targets such as the U.S. Office of Personnel Management. But assaults on the power grid and other critical infrastructure aim to go a step further. 
 
 Trained, well-funded adversaries can gain control of physical assets — power plants, substations and transmission equipment. With extensive control, they could knock out the electricity vital to daily life and the economy, and endanger the flow of power to mass transportation, military installations and home refrigerators. 
 
 In the summer of 2014, a hacker of unknown origin, using masking software called Tor, took over the controls of a large utility's wind farm, according to a former industry compliance official who reviewed a report that was scrubbed of the utility's name. The hacker then changed an important setting, called the automatic voltage regulator, from "automatic" to "manual," he said. 
 
 That seemingly simple change to any power plant can damage the generator and destabilize parts of the nearby grid if the plant's output is high enough. 
 
 Last year, Homeland Security released several maps that showed a virtual hit list of critical infrastructure, including two substations in the San Francisco Bay area, water and gas pipelines and a refinery. And according to a previously reported study by the Federal Energy Regulatory Commission, a coordinated attack on just nine critical power stations could cause a coast-to-coast blackout that could last months, far longer than the one that plunged the Northeast into darkness in 2003. 
 
 "The grid is a tough target, but a lucrative target," said Keith Alexander, the former director of the National Security Agency who now runs a cybersecurity firm. The number of sophisticated attacks is growing, he said. "There is a constant, steady upbeat. I see a rising tide." 
 
 No one claims that it would be easy to bring down the grid. To circumvent companies' security, adversaries must understand the networks well enough to write code that can communicate with tiny computers that control generators and other major equipment. Even then, it's difficult to cause a widespread blackout because the grid is designed to keep electricity flowing when equipment or lines go down, an almost daily occurrence that customers never see. 
 
 Because it would take such expertise to plunge a city or region into darkness, some say threats to the grid are overstated — in particular, by those who get paid to help companies protect their networks. Still, even those who said the risks of cyber threats can be exaggerated agree it is possible for cyberattackers to cause a large-scale blackout. 
 
 And nearly everyone agrees that there are weaknesses that open the door to malefactors. 
 
 Traditional central power stations and transmission systems include equipment that is decades old and physically unable to handle electronic threats. Some run on machines that use software that is so old that malware protections don't exist, such as Windows '95 and FORTRAN, a programming language developed in the 1950s. 
 
 At the Tennessee Valley Authority, a corporation owned by the federal government that powers 9 million households in the southeastern U.S., a former operations security expert said in recent years he saw passwords for some key operating systems stored on sticky notes. 
 
 "Some of the control systems boot off of floppy disks," said Patrick Miller, who has evaluated hydroelectric dam cybersecurity for the U.S. Bureau of Reclamation and Army Corps of Engineers. "Some dams have modeling systems that run on something that looks like a washing machine hooked up to tape spools. It looks like the early NASA stuff that went to the moon." 
 
 The rush to tie smart meters, home programmable thermostats and other smart appliances to the grid also is causing fresh vulnerabilities. 
 
 About 45 percent of homes in the U.S. are hooked up to a smart meter, which measures electricity usage and shares information with the grid. The grid uses that information to adjust output or limit power deliveries to customers during peak hours. 
 
 Those meters are relatively simple by design, mostly to keep their cost low, but their security is flimsy. Some can be hacked by plugging in an adapter that costs $30 on eBay, researchers say. 
 
 FERC recently raised concerns about another area that is not covered by federal cybersecurity rules: contractors that sell energy companies software and equipment. As is evident from the Calpine incident, attackers have used outside companies to pull off hacks against energy companies. 
 
 "We've got these vulnerable systems out there that are old and never had security built into them, and now we're exposing them to a wider audience," said Justin Lowe, a utility cybersecurity expert at PA Consulting Group. 
 
 "That wider audience is getting much more hostile." 
 
 ___ 
 
 DEFENDING THE GRID 
 
 The full extent of the attacks on the grid is not public knowledge. A Freedom of Information Act request by the AP for information regarding any FBI investigations of such hacks was not fulfilled. The Department of Justice said that agency kept no record of how often any such cases had been prosecuted. 
 
 The North American Electric Reliability Corporation, which oversees the reliability of the electrical sector, collects information about cyber incidents involving utilities and other users, owners, and operators of the bulk power system — but it is scrubbed of identifying information and details are confidential and exempt from disclosure under FOIA. 
 
 Authorities say they take the threat seriously. In response to a FOIA request, Homeland Security said it had helped more than 100 energy and chemical companies improve their cyber defenses, and held both classified and unclassified briefings in June 2013 and late 2014 on threats to companies associated with power grid operations. 
 
 A small DHS team compiles statistics about hacks and vulnerabilities on control systems powering the grid and other public infrastructure, and responds to some attacks. But former federal employees who spoke on the condition of anonymity because the information was sensitive said government red tape kept the team from thoroughly responding to the smaller municipal and rural utilities that most needed their help, and that the statistics overstated the agency's grasp of the problem. 
 
 The companies themselves say they are vigilant — though they caution no fortifications are foolproof. 
 
 Early this year, an operations supervisor in Virginia for a subsidiary of American Electric Power — the nation's largest power grid operator, with operations in 38 states — opened a personal email on a company laptop and unwittingly downloaded a piece of malware called CryptoLocker. 
 
 Known as "ransomware," CryptoLocker is a relatively common type of malware that reaches to outside servers, usually overseas, and downloads encryption instructions that scramble a computer's contents, making them inaccessible to anyone without a specific "key." The malware then moves through a computer — and computer network — and encrypts all the files it can, keeping users from accessing anything. 
 
 In exchange for a fee, the hackers provide the victim a key that allows the files to be unlocked. 
 
 Members of AEP's cyber-security team — housed in the company's Columbus, Ohio, headquarters behind an unmarked door that unlocks with a fingerprint scanner — saw the strange network behavior as soon as it started. 
 
 "When you see this (code) attempting to hit thousands of systems outside of the AEP network, that's a 'holy crap' moment," said Sean Parcel, AEP's lead cyberinvestigator. 
 
 Had CryptoLocker wormed its way into AEP's system, the business and operations networks could have locked up, experts say. 
 
 But Parcel said AEP's cyberteam already had blocked the foreign addresses that the malware needed to reach to start encrypting files, part of a policy of systematically blocking hundreds of Internet Protocol addresses each week to keep employees from inadvertently downloading malicious code. 
 
 AEP said the team remotely isolated and erased the supervisor's computer before its systems were affected. 
 
 Like most big utilities, AEP's power plants, substations and other vital equipment are managed by a network that is separated from the company's business software with layers of authentication, and is not accessible via the Internet. Creating that separation, and making sure that separation is maintained, is among the most important things utilities can do to protect the grid's physical assets. 
 
 But cybersecurity experts say the protective gaps between computer systems that manage utilities' business operations and machines that manage their grids are not always as wide or as unbridgeable as utilities say they are. And even the utilities' own experts, who maintain it would be extraordinarily difficult for a hacker to knock out power to customers, admit there is always a way in. 
 
 "If the motivation is high enough on the attacker side, and they have funding to accomplish their mission," Parcel said, "they will find a way." 
 
 ___ 
 
 Jonathan Fahey reported from New York and Columbus, Ohio. 
 
 ___ 
 
 The AP National Investigative Team can be reached at investigate@ap.org ||||| SAN JOSE, Calif. (AP) — Security researcher Brian Wallace was on the trail of hackers who had snatched a California university's housing files when he stumbled into a larger nightmare: Cyberattackers had opened a pathway into the networks running the United States power grid. 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 ADVANCE FOR USE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) AND THEREAFTER; THIS STORY MAY NOT BE PUBLISHED, BROADCAST OR POSTED ONLINE BEFORE MONDAY, DEC. 21, 2015 AT 3:01 A.M. EST (2201 GMT) -... (Associated Press) 
 
 Digital clues pointed to Iranian hackers. And Wallace found that they had already taken passwords, as well as engineering drawings of dozens of power plants, at least one with the title "Mission Critical." The drawings were so detailed that experts say skilled attackers could have used them, along with other tools and malicious code, to knock out electricity flowing to millions of homes. 
 
 Wallace was astonished. But this breach, The Associated Press has found, was not unique. 
 
 About a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter. 
 
 The public almost never learns the details about these types of attacks — they're rarer but also more intricate and potentially dangerous than data theft. Information about the government's response to these hacks is often protected and sometimes classified; many are never even reported to the government. 
 
 These intrusions have not caused the kind of cascading blackouts that are feared by the intelligence community. But so many attackers have stowed away in the systems that run the U.S. electric grid that experts say they likely have the capability to strike at will. 
 
 And that's what worries Wallace and other cybersecurity experts most. 
 
 "If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier," said Robert M. Lee, a former U.S. Air Force cyberwarfare operations officer. "It will also help them stay quiet and stealthy inside." 
 
 In 2012 and 2013, in well-publicized attacks, Russian hackers successfully sent and received encrypted commands to U.S. public utilities and power generators; some private firms concluded this was an effort to position interlopers to act in the event of a political crisis. And the Department of Homeland Security announced about a year ago that a separate hacking campaign, believed by some private firms to have Russian origins, had injected software with malware that allowed the attackers to spy on U.S. energy companies. 
 
 "You want to be stealth," said Lillian Ablon, a cybersecurity expert at the RAND Corporation. "That's the ultimate power, because when you need to do something you are already in place." 
 
 The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking the plants up to the Internet over the last decade has given hackers new backdoors in. Distant wind farms, home solar panels, smart meters and other networked devices must be remotely monitored and controlled, which opens up the broader system to fresh points of attack. 
 
 Hundreds of contractors sell software and equipment to energy companies, and attackers have successfully used those outside companies as a way to get inside networks tied to the grid. 
 
 Attributing attacks is notoriously tricky. Neither U.S. officials nor cybersecurity experts would or could say if the Islamic Republic of Iran was involved in the attack Wallace discovered involving Calpine Corp., a power producer with 82 plants operating in 18 states and Canada. 
 
 Private firms have alleged other recent hacks of networks and machinery tied to the U.S. power grid were carried out by teams from within Russia and China, some with governmental support. 
 
 Even the Islamic State group is trying to hack American power companies, a top Homeland Security official told industry executives in October. 
 
 Homeland Security spokesman SY Lee said that his agency is coordinating efforts to strengthen grid cybersecurity nationwide and to raise awareness about evolving threats to the electric sector through industry trainings and risk assessments. As Deputy Secretary Alejandro Mayorkas acknowledged in an interview, however, "we are not where we need to be" on cybersecurity. 
 
 That's partly because the grid is largely privately owned and has entire sections that fall outside federal regulation, which experts argue leaves the industry poorly defended against a growing universe of hackers seeking to access its networks. 
 
 As Deputy Energy Secretary Elizabeth Sherwood Randall said in a speech earlier this year, "If we don't protect the energy sector, we are putting every other sector of the economy in peril." 
 
 ___ 
 
 THE CALPINE BREACH 
 
 The AP looked at the vulnerability of the energy grid as part of a yearlong, AP-Associated Press Media Editors examination of the state of the nation's infrastructure. AP conducted more than 120 interviews and examined dozens of sets of data, government reports and private analyses to gauge whether the industry is prepared to defend against cyberattacks. 
 
 The attack involving Calpine is particularly disturbing because the cyberspies grabbed so much, according to interviews and previously unreported documents. 
 
 Cybersecurity experts say the breach began at least as far back as August 2013, and could still be going on today. 
 
 Calpine spokesman Brett Kerr said the company's information was stolen from a contractor that does business with Calpine. He said the stolen diagrams and passwords were old — some diagrams dated to 2002 — and presented no threat, though some outside experts disagree. 
 
 Kerr would not say whether the configuration of the power plants' operations networks — also valuable information — remained the same as when the intrusion occurred, or whether it was possible the attackers still had a foothold. 
 
 According to the AP investigation, the hackers got: 
 
 —User names and passwords that could be used to connect remotely to Calpine's networks, which were being maintained by a data security company. Even if some of the information was outdated, experts say skilled hackers could have found a way to update the passwords and slip past firewalls to get into the operations network. Eventually, they say, the intruders could shut down generating stations, foul communications networks and possibly cause a blackout near the plants. 
 
 —Detailed engineering drawings of networks and power stations from New York to California — 71 in all — showing the precise location of devices that communicate with gas turbines, boilers and other crucial equipment attackers would need to hack specific plants. 
 
 —Additional diagrams showing how those local plants transmit information back to the company's virtual cloud, knowledge attackers could use to mask their activity. For example, one map shows how information flows from the Agnews power plant in San Jose, California, near the San Francisco 49ers football stadium, to the company headquarters in Houston. 
 
 Wallace first came across the breach while tracking a new strain of noxious software that had been used to steal student housing files at the University of California, Santa Barbara. 
 
 "I saw a mention in our logs that the attackers stored their malware in some FTP servers online," said Wallace, who had recently joined the Irvine, Calif.-based cybersecurity firm Cylance, Inc., fresh out of college. "It wasn't even my job to look into it, but I just thought there had to be something more there." 
 
 Wallace started digging. Soon, he found the FTP servers, typically used to transfer large numbers of files back and forth across the Internet, and the hackers' ill-gotten data — a tranche of more than 19,000 stolen files from thousands of computers across the world, including key documents from Calpine. 
 
 Before Wallace could dive into the files, his first priority was to track where the hackers would strike next — and try to stop them. 
 
 He started staying up nights, often jittery on Red Bull, to reverse-engineer malware. He waited to get pinged that the intruders were at it again. 
 
 Months later, Wallace got the alert: From Internet Protocol addresses in Tehran, the hackers had deployed TinyZbot, a Trojan horse-style of software that the attackers used to gain backdoor access to their targets, log their keystrokes and take screen shots of their information. The hacking group, he would find, included members in the Netherlands, Canada, and the United Kingdom. 
 
 The more he followed their trail, the more nervous Wallace got. According to Cylance, the intruders had launched digital offensives that netted information about Pakistan International Airlines, the Mexican oil giant Pemex, the Israel Institute of Technology and Navy Marine Corps Intranet, a legacy network of the U.S. military. None of the four responded to AP's request for comment. 
 
 Then he discovered evidence of the attackers' most terrifying heist — a folder containing dozens of engineers' diagrams of the Calpine power plants. 
 
 According to multiple sources, the drawings contained user names and passwords that an intruder would need to break through a firewall separating Calpine's communications and operations networks, then move around in the network where the turbines are controlled. The schematics also displayed the locations of devices inside the plants' process control networks that receive information from power-generating equipment. With those details, experts say skilled hackers could have penetrated the operations network and eventually shut down generating stations, possibly causing a blackout. 
 
 Cylance researchers said the intruders stored their stolen goods on seven unencrypted FTP servers requiring no authentication to access details about Calpine's plants. Jumbled in the folders was code that could be used to spread malware to other companies without being traced back to the attackers' computers, as well as handcrafted software designed to mask that the Internet Protocol addresses they were using were in Iran. 
 
 Circumstantial evidence such as snippets of Persian comments in the code helped investigators conclude that Iran was the source of the attacks. 
 
 Calpine didn't know its information had been compromised until it was informed by Cylance, Kerr said. 
 
 Iranian U.N. Mission spokesman Hamid Babaei did not return calls or address questions emailed by AP. 
 
 Cylance notified the FBI, which warned the U.S. energy sector in an unclassified bulletin last December that a group using Iran-based IP addresses had targeted the industry. 
 
 Whether there was any connection between the Iranian government and the individual hackers who Wallace traced — with the usernames parviz, Alireza, Kaj, Salman Ghazikhani and Bahman Mohebbi — is unclear. 
 
 ___ 
 
 A 'LUCRATIVE' TARGET 
 
 Cyberattacks designed to steal information are steadily growing in scope and frequency; there have been high-profile hacks of Target, eBay and federal targets such as the U.S. Office of Personnel Management. But assaults on the power grid and other critical infrastructure aim to go a step further. 
 
 Trained, well-funded adversaries can gain control of physical assets — power plants, substations and transmission equipment. With extensive control, they could knock out the electricity vital to daily life and the economy, and endanger the flow of power to mass transportation, military installations and home refrigerators. 
 
 In the summer of 2014, a hacker of unknown origin, using masking software called Tor, took over the controls of a large utility's wind farm, according to a former industry compliance official who reviewed a report that was scrubbed of the utility's name. The hacker then changed an important setting, called the automatic voltage regulator, from "automatic" to "manual," he said. 
 
 That seemingly simple change to any power plant can damage the generator and destabilize parts of the nearby grid if the plant's output is high enough. 
 
 Last year, Homeland Security released several maps that showed a virtual hit list of critical infrastructure, including two substations in the San Francisco Bay area, water and gas pipelines and a refinery. And according to a previously reported study by the Federal Energy Regulatory Commission, a coordinated attack on just nine critical power stations could cause a coast-to-coast blackout that could last months, far longer than the one that plunged the Northeast into darkness in 2003. 
 
 "The grid is a tough target, but a lucrative target," said Keith Alexander, the former director of the National Security Agency who now runs a cybersecurity firm. The number of sophisticated attacks is growing, he said. "There is a constant, steady upbeat. I see a rising tide." 
 
 No one claims that it would be easy to bring down the grid. To circumvent companies' security, adversaries must understand the networks well enough to write code that can communicate with tiny computers that control generators and other major equipment. Even then, it's difficult to cause a widespread blackout because the grid is designed to keep electricity flowing when equipment or lines go down, an almost daily occurrence that customers never see. 
 
 Because it would take such expertise to plunge a city or region into darkness, some say threats to the grid are overstated — in particular, by those who get paid to help companies protect their networks. Still, even those who said the risks of cyber threats can be exaggerated agree it is possible for cyberattackers to cause a large-scale blackout. 
 
 And nearly everyone agrees that there are weaknesses that open the door to malefactors. 
 
 Traditional central power stations and transmission systems include equipment that is decades old and physically unable to handle electronic threats. Some run on machines that use software that is so old that malware protections don't exist, such as Windows '95 and FORTRAN, a programming language developed in the 1950s. 
 
 At the Tennessee Valley Authority, a corporation owned by the federal government that powers 9 million households in the southeastern U.S., a former operations security expert said in recent years he saw passwords for some key operating systems stored on sticky notes. 
 
 "Some of the control systems boot off of floppy disks," said Patrick Miller, who has evaluated hydroelectric dam cybersecurity for the U.S. Bureau of Reclamation and Army Corps of Engineers. "Some dams have modeling systems that run on something that looks like a washing machine hooked up to tape spools. It looks like the early NASA stuff that went to the moon." 
 
 The rush to tie smart meters, home programmable thermostats and other smart appliances to the grid also is causing fresh vulnerabilities. 
 
 About 45 percent of homes in the U.S. are hooked up to a smart meter, which measures electricity usage and shares information with the grid. The grid uses that information to adjust output or limit power deliveries to customers during peak hours. 
 
 Those meters are relatively simple by design, mostly to keep their cost low, but their security is flimsy. Some can be hacked by plugging in an adapter that costs $30 on eBay, researchers say. 
 
 FERC recently raised concerns about another area that is not covered by federal cybersecurity rules: contractors that sell energy companies software and equipment. As is evident from the Calpine incident, attackers have used outside companies to pull off hacks against energy companies. 
 
 "We've got these vulnerable systems out there that are old and never had security built into them, and now we're exposing them to a wider audience," said Justin Lowe, a utility cybersecurity expert at PA Consulting Group. 
 
 "That wider audience is getting much more hostile." 
 
 ___ 
 
 DEFENDING THE GRID 
 
 The full extent of the attacks on the grid is not public knowledge. A Freedom of Information Act request by the AP for information regarding any FBI investigations of such hacks was not fulfilled. The Department of Justice said that agency kept no record of how often any such cases had been prosecuted. 
 
 The North American Electric Reliability Corporation, which oversees the reliability of the electrical sector, collects information about cyber incidents involving utilities and other users, owners, and operators of the bulk power system — but it is scrubbed of identifying information and details are confidential and exempt from disclosure under FOIA. 
 
 Authorities say they take the threat seriously. In response to a FOIA request, Homeland Security said it had helped more than 100 energy and chemical companies improve their cyber defenses, and held both classified and unclassified briefings in June 2013 and late 2014 on threats to companies associated with power grid operations. 
 
 A small DHS team compiles statistics about hacks and vulnerabilities on control systems powering the grid and other public infrastructure, and responds to some attacks. But former federal employees who spoke on the condition of anonymity because the information was sensitive said government red tape kept the team from thoroughly responding to the smaller municipal and rural utilities that most needed their help, and that the statistics overstated the agency's grasp of the problem. 
 
 The companies themselves say they are vigilant — though they caution no fortifications are foolproof. 
 
 Early this year, an operations supervisor in Virginia for a subsidiary of American Electric Power — the nation's largest power grid operator, with operations in 38 states — opened a personal email on a company laptop and unwittingly downloaded a piece of malware called CryptoLocker. 
 
 Known as "ransomware," CryptoLocker is a relatively common type of malware that reaches to outside servers, usually overseas, and downloads encryption instructions that scramble a computer's contents, making them inaccessible to anyone without a specific "key." The malware then moves through a computer — and computer network — and encrypts all the files it can, keeping users from accessing anything. 
 
 In exchange for a fee, the hackers provide the victim a key that allows the files to be unlocked. 
 
 Members of AEP's cyber-security team — housed in the company's Columbus, Ohio, headquarters behind an unmarked door that unlocks with a fingerprint scanner — saw the strange network behavior as soon as it started. 
 
 "When you see this (code) attempting to hit thousands of systems outside of the AEP network, that's a 'holy crap' moment," said Sean Parcel, AEP's lead cyberinvestigator. 
 
 Had CryptoLocker wormed its way into AEP's system, the business and operations networks could have locked up, experts say. 
 
 But Parcel said AEP's cyberteam already had blocked the foreign addresses that the malware needed to reach to start encrypting files, part of a policy of systematically blocking hundreds of Internet Protocol addresses each week to keep employees from inadvertently downloading malicious code. 
 
 AEP said the team remotely isolated and erased the supervisor's computer before its systems were affected. 
 
 Like most big utilities, AEP's power plants, substations and other vital equipment are managed by a network that is separated from the company's business software with layers of authentication, and is not accessible via the Internet. Creating that separation, and making sure that separation is maintained, is among the most important things utilities can do to protect the grid's physical assets. 
 
 But cybersecurity experts say the protective gaps between computer systems that manage utilities' business operations and machines that manage their grids are not always as wide or as unbridgeable as utilities say they are. And even the utilities' own experts, who maintain it would be extraordinarily difficult for a hacker to knock out power to customers, admit there is always a way in. 
 
 "If the motivation is high enough on the attacker side, and they have funding to accomplish their mission," Parcel said, "they will find a way." 
 
 ___ 
 
 Jonathan Fahey reported from New York and Columbus, Ohio. 
 
 ___ 
 
 The AP National Investigative Team can be reached at investigate@ap.org ||||| SHARE THIS ARTICLE Share Tweet Post Email 
 
 Hackers working for a foreign government recently breached at least a dozen U.S. power plants, including the Wolf Creek nuclear facility in Kansas, according to current and former U.S. officials, sparking concerns the attackers were searching for vulnerabilities in the electrical grid. 
 
 The intruders could be positioning themselves to eventually disrupt the nation’s power supply, warned the officials, who noted that a general alert was distributed to utilities a week ago. Adding to those concerns, hackers recently infiltrated an unidentified company that makes control systems for equipment used in the power industry, an attack that officials believe may be related. 
 
 The chief suspect is Russia, according to three people familiar with the continuing effort to eject the hackers from the computer networks. One of those networks belongs to an aging nuclear generating facility known as Wolf Creek -- owned by Westar Energy Inc., Great Plains Energy Inc. and Kansas Electric Power Cooperative Inc. -- on a lake shore near Burlington, Kansas. 
 
 The possibility of a Russia connection is particularly worrisome, former and current officials say, because Russian hackers have previously taken down parts of the electrical grid in Ukraine and appear to be testing increasingly advanced tools to disrupt power supplies. 
 
 The hacks come as international tensions have flared over U.S. intelligence agencies’ conclusion that Russia tried to influence the 2016 presidential election. The U.S., which has several continuing investigations into Russia’s activities, is known to possess digital weapons capable of disrupting the electricity grids of rival nations. 
 
 “We don’t pay attention to such anonymous fakes,” Kremlin spokesman Dmitry Peskov said, in response to a request to comment on alleged Russian involvement. 
 
 It was unclear whether President Donald Trump was planning to address the cyberattacks at his meeting on Friday with Russian President Vladimir Putin. In an earlier speech in Warsaw, Trump called out Russia’s “destabilizing activities” and urged the country to join “the community of responsible nations.” 
 
 The Department of Homeland Security and Federal Bureau of Investigation said they are aware of a potential intrusion in the energy sector. The alert issued to utilities cited activities by hackers since May. 
 
 “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks,” the government agencies said in a joint statement. 
 
 The Department of Energy also said the impact appears limited to administrative and business networks and said it was working with utilities and grid operators to enhance security and resilience. 
 
 “Regardless of whether malicious actors attempt to exploit business networks or operational systems, we take any reports of malicious cyber activity potentially targeting our nation’s energy infrastructure seriously and respond accordingly,” the department said in an emailed statement. 
 
 Representatives of the National Security Council, the Director of National Intelligence and the Nuclear Regulatory Commission declined to comment. While Bloomberg News was waiting for responses from the government, the New York Times reported that hacks were targeting nuclear power stations. 
 
 The North American Electric Reliability Corp., a nonprofit that works to ensure the reliability of the continent’s power system, said it was aware of the incident and was exchanging information with the industry through a secure portal. “At this time, there has been no bulk power system impact in North America,” the corporation said in an emailed statement. 
 
 In addition, the operational controls at Wolf Creek were not pierced, according to government officials. “There was absolutely no operational impact to Wolf Creek,” Jenny Hageman, a spokeswoman for the nuclear plant, said in a statement to Bloomberg News. “The reason that is true is because the operational computer systems are completely separate from the corporate network.” 
 
 Determining who is behind an attack can be tricky. Government officials look at the sophistication of the tools, among other key markers, when gauging whether a foreign government is sponsoring cyber activities. 
 
 Several private security firms are studying data on the attacks, but none has linked the work to a particular hacking team or country. 
 
 “We don’t tie this to any known group at this point,” said Sean McBride, a lead analyst for FireEye Inc., a global cybersecurity firm. “It’s not to say it’s not related, but we don’t have the evidence at this point.” 
 
 U.S. intelligence officials have long been concerned about the security of the country’s electrical grid. The recent attack, striking almost simultaneously at multiple locations, is testing the government’s ability to coordinate an effective response among several private utilities, state and local officials, and industry regulators. 
 
 Specialized teams from Homeland Security and the FBI have been scrambled to help extricate the hackers from the power stations, in some cases without informing local and state officials. Meanwhile, the U.S. National Security Agency is working to confirm the identity of the hackers, who are said to be using computer servers in Germany, Italy, Malaysia and Turkey to cover their tracks. 
 
 Many of the power plants are conventional, but the targeting of a nuclear facility adds to the pressure. While the core of a nuclear generator is heavily protected, a sudden shutdown of the turbine can trigger safety systems. These safety devices are designed to disperse excess heat while the nuclear reaction is halted, but the safety systems themselves may be vulnerable to attack. 
 
 Homeland Security and the FBI sent out a general warning about the cyberattack to utilities and related parties on June 28, though it contained few details or the number of plants affected. The government said it was most concerned about the “persistence” of the attacks on choke points of the U.S. power supply. That language suggests hackers are trying to establish backdoors on the plants’ systems for later use, according to a former senior DHS official who asked not to be identified. 
 
 Those backdoors can be used to insert software specifically designed to penetrate a facility’s operational controls and disrupt critical systems, according to Galina Antova, co-founder of Claroty, a New York firm that specializes in securing industrial control systems. 
 
 “We’re moving to a point where a major attack like this is very, very possible,” Antova said. “Once you’re into the control systems -- and you can get into the control systems by hacking into the plant’s regular computer network -- then the basic security mechanisms you’d expect are simply not there.” 
 
 The situation is a little different at nuclear facilities. Backup power supplies and other safeguards at nuclear sites are meant to ensure that “you can’t really cause a nuclear plant to melt down just by taking out the secondary systems that are connected to the grid,” Edwin Lyman, a nuclear expert with the Union of Concerned Scientists, said in a phone interview. 
 
 The operating systems at nuclear plants also tend to be legacy controls built decades ago and don’t have digital control systems that can be exploited by hackers. Wolf Creek, for example, began operations in 1985. “They’re relatively impervious to that kind of attack,” Lyman said. 
 
 The alert sent out last week inadvertently identified Wolf Creek as one of the victims of the attack. An analysis of one of the tools used by the hackers had the stolen credentials of a plant employee, a senior engineer. A U.S. official acknowledged the error was not caught until after the alert was distributed. 
 
 According to a security researcher who has seen the report, the malware that activated the engineer’s username and password was designed to be used once the hackers were already inside the plant’s computer systems. 
 
 The tool tries to connect to non-public computers, and may have been intended to identify systems related to Wolf Creek’s generation plant, a part of the facility typically more modern than the nuclear reactor control room, according to a security expert who asked to note be identified because the alert is not public. 
 
 Even if there is no indication that the hackers gained access to those control systems, the design of the malware suggests they may have at least been looking for ways to do so, the expert said. 
 
 Stan Luke, the mayor of Burlington, the largest community near Wolf Creek, which is surrounded by corn fields and cattle pastures, said he learned about a cyber threat at the plant only recently, and then only through golfing buddies. 
 
 With a population of just 2,700, Burlington boasts a community pool with three water slides and a high school football stadium that would be the envy of any junior college. Luke said those amenities lead back to the tax dollars poured into the community by Wolf Creek, Coffey County’s largest employer with some 1,000 workers, 600 of whom live in the county. 
 
 E&E News first reported on digital attacks targeting U.S. nuclear plants, adding it was code-named Nuclear 17. A senior U.S. official told Bloomberg that there was a bigger breach of conventional plants, which could affect multiple regions. 
 
 Industry experts and U.S. officials say the attack is being taken seriously, in part because of recent events in Ukraine. Antova said that the Ukrainian power grid has been disrupted at least twice, first in 2015, and then in a more automated attack last year, suggesting the hackers are testing methods. 
 
 Scott Aaronson, executive director for security and business continuity at the Edison Electric Institute, an industry trade group, said utilities, grid operators and federal officials were already dissecting the attack on Ukraine’s electric sector to apply lessons in North America before the U.S. government issued the latest warning to “energy and critical manufacturing sectors.” The current threat is unrelated to recently publicized ransomware incidents or the CrashOverride malware, Aaronson said in an emailed statement. 
 
 Neither attack in Ukraine caused long-term damage. But with each escalation, the hackers may be gauging the world’s willingness to push back. 
 
 “If you think about a typical war, some of the acts that have been taken against critical infrastructure in Ukraine and even in the U.S., those would be considered crossing red lines,” Antova said. 
 
 For more on cyber security, check out the Decrypted podcast: 
 
 — With assistance by Charlotte Chilton
– Iranian hackers who targeted American financial institutions two years ago were also apparently curious about a small dam in upstate New York—and officials are worried what this means for the security of US industrial infrastructure overall, the Wall Street Journal reports. The hackers reportedly infiltrated the controls for the facility—IDed by Journal sources as the Bowman Avenue Dam near Rye—in 2013 through a cellular modem, per an unclassified Homeland Security document. And while the interlopers didn't wrest control of the dam, it appears they poked around quite a bit—underscoring how easy it is to break into the more than 57,000 systems for US power grids, pipelines, bridges, and dams, many of which are antiquated and virtually unprotected, the Journal notes. In fact, per a separate AP investigation, "sophisticated foreign hackers" have accessed about a dozen power networks here, attacks that the AP says the US public is rarely informed about. US infrastructure is often run by creaky systems that were previously offline, which kept them relatively safe. But, "against the advice of hacking gurus," as the Journal notes, many companies started connecting their systems to the Internet without adequately securing them. And the number of such hacks has been creeping up since. Per Homeland Security data, over the 12 months ending Sept. 30, it took in and responded to 295 incidents, up from 245 the year before, per the Journal. Possible consequences: hackers causing a flood, explosion, or even bumper-to-bumper traffic, either by accident or intentionally. A Homeland Security official recently told energy execs at a conference that even ISIS "is beginning to perpetrate cyberattacks," per the Hill. In the Bowman Dam incident, the White House was informed because officials initially thought the hack was against Oregon's larger Arthur R. Bowman Dam, per the Journal. (The AP investigation chillingly reveals how hot a target the US power grid has been.)