On October 22 the United Kingdom launched a campaign asking households to keep enough food and water on hand to get through about three days without power, water, phone service or internet. The UK said it was catching up with France, Ireland and the Netherlands. By one count at least 33 countries now give their people some version of that advice, and that figure comes from minimal sources. Sweden and Norway say plan for up to a week. Germany says up to 10 days. Our own federal guidance asks Americans for several days of food, water and essentials and never commits to a number.
I don’t read any of this as governments expecting a war next month. They’re saying out loud what every emergency manager already knows: for the first three days most families are on their own, because the responders are busy with the people who can’t help themselves. The British put it in almost those words. If the households that can prepare actually, do it, emergency services can spend their time on the people most in need.
Iranian-linked attacks on U.S. water systems in 2026
On April 7 the FBI, CISA, NSA, EPA, Department of Energy and U.S. Cyber Command put out joint advisory AA26-097A, and Treasury signed on when it was updated July 22. Iranian-affiliated actors had been getting into internet-facing programmable logic controllers, the small industrial computers that open valves and run pumps, at water utilities, energy facilities and local governments since at least March. They rewrote logic, changed what operators saw on their HMI and SCADA screens, and in some cases disabled shutdown and alarm logic. Some victims took operational disruption and financial loss. The agencies tied the escalation to hostilities between Iran and the United States and Israel.
Then it happened at scale. On July 26 and 27 a coordinated attack disrupted water and wastewater operations in more than 30 Minnesota communities, and a cyber-caused pressure drop at the Clayton County Water Authority in Georgia put 300,000 customers in the Atlanta area under a boil-water advisory. The count reached at least 12 states. CISA later said it saw malicious activity against more than 100 internet-exposed water systems in July alone, most of them PLCs wired straight to a cellular modem, often with default or weak passwords.
That last detail is the one that gets me. None of this was sophisticated. It’s a controller sitting on the public internet with the password it shipped with, and we’ve been preaching about that kind of cyber hygiene in tabletop exercises for years. The good news is the fix is cheap compared to the cleanup.
If you’re an elected official, you don’t need to know what a PLC is to ask your utility director three questions at the next meeting. Is any of our control equipment reachable from the internet, including through a cellular modem? Have the default passwords been changed on every device? If the screens went bad tomorrow, could the crew run the plant by hand, and when did they last practice it? The advisory’s own list starts with pulling PLCs off direct internet exposure, requiring MFA for remote access and keeping offline, tested backups of the controller logic.
The power grid got fewer headlines, but Energy is named as a target sector in that same advisory and DOE is one of the authors. In a lot of small Texas towns the same small crew looks after the water plant and the lift stations and answers the phone when the lights go out, which is why I’d ask those three questions about both.
Flooding in Texas and New Mexico: no password required
While the cybersecurity threats are getting the attention, we cannot forget about weather related emergencies.
The July 4, 2025 flood in the Hill Country killed at least 135 people, 117 of them in Kerr County, including 37 children. AccuWeather put total damage and economic loss at $18 billion to $22 billion, and that estimate counts supply chain interruptions, extended power outages, road closures and lost tourism along with the homes and camps.
The Guadalupe came back this summer. Flooding that started July 12 across the Hill Country and South Texas killed three people and took more than 500 rescues, and the state put more than 2,700 personnel, 22 boats and 20 aircraft on it. In Kerr County alone 135 homes were destroyed or heavily damaged and another 490 damaged, along with about 100 businesses. Gov. Abbott said the flooding in Kerrville was worse than 2025’s, even with a fraction of the deaths.
New Mexico got hit in October. In San Juan County, evacuation orders covered about 1,500 residences, roughly 500 homes were damaged in the Shiprock area on the Navajo Nation, and floodwater inundated the Bloomfield water reclamation plant. Think about that plant for a second. The family downstream doesn’t care whether it was a PLC or the San Juan River that took it down, the boil-water notice reads the same, and so does the plan for getting through it. Gov. Michelle Lujan Grisham estimated recovery could cost $200 million to $300 million.
What COVID-19 taught us about supply chains
Don’t forget what we learned about supply chain vulnerabilities that were on full display due to the COVID-19 pandemic. In September 2020, six months in, the GAO reported that states still couldn’t get enough PPE and testing supplies, because demand was high and domestic production of those items was limited.
Cyber security and attacks on the supply chain can have a subtle but very deliberate effect on our lives in the United States. In June 2025 a cyberattack on United Natural Foods, the main distributor for Whole Foods, left shelves empty at stores and co-ops around the country, and the company told investors it expected a $350 million to $400 million hit to sales. Nobody touched a farm or a truck. They hit the system that tells the trucks where to go. Four years earlier ransomware shut down Colonial Pipeline, which runs more than 5,500 miles from Texas to New Jersey and carries close to half of the East Coast’s fuel to more than 50 million people. You remember the gas lines. Most people never connected them to a computer.
That’s the part that worries me going into 2027. A flood announces itself. A supply chain attack shows up as a shortage of one thing at one store, then another, and by the time somebody calls it an incident the shelves have been thin for a week.
I’ve spent more than 25 years in emergency management, public safety and IT here in Texas, and the people I trusted most on bad days were the ones I already knew before the phone rang. Build that network now. Get your utility people, your IT staff, your county EMC and your local FBI and InfraGard contacts in the same room for a tabletop before you need them and get your elected officials into the training while it’s still optional. Nobody learns ICS in the middle of a flood. You learn it in a classroom, and you use it in the flood.
And tell your residents the same thing the British just told theirs: three days of water, food, medicine, cash and a battery radio.
FEMA and the FCC will run a nationwide test of the Emergency Alert System on Tuesday, November 17, at 1:20 p.m. Central, with December 3 as the backup date. It goes out on radio and TV only. Cell phones will not alert as part of this test.
