War-Gamed Blackouts: How Utilities Are Preparing for Attacks on the Grid

The lights going out during a World Cup match or an Olympic opening ceremony would be embarrassing. The lights going out across an entire host city, during a heat wave, because of a coordinated physical attack on the power grid, would be catastrophic. That distinction is exactly what a recent grid security exercise forced utility planners to sit with.

The scenario, built around a fictional nation called Beryllia hosting the 2026 World Chalice Games, was designed with uncomfortable specificity. A rival state, Crimsonia, launches a coordinated campaign against the grid: vandalism at substations, drone strikes, and ballistic attacks, all while a heat wave is already pushing demand to its limits. The exercise drew direct inspiration from two real and imminent events: the 2026 FIFA World Cup and the 2028 Summer Olympics in Los Angeles. The message embedded in the fiction was plain enough. These are not hypothetical threats being stress-tested for some distant future. They are rehearsals for something planners believe is genuinely possible.

For most of the 20th century, the primary threats to grid infrastructure were weather and equipment failure. Hardening the grid meant burying cables, trimming trees near power lines, and building redundancy into transmission systems. The adversary was entropy, not intent. That calculus has shifted considerably.

Physical attacks on U.S. electrical infrastructure have been rising. The Federal Energy Regulatory Commission has documented a steady increase in reported physical security incidents at power facilities over the past decade. The 2013 sniper attack on Pacific Gas and Electric's Metcalf transmission substation in California, which knocked out 17 transformers and caused roughly $15 million in damage, remains a reference point in the industry precisely because it demonstrated how vulnerable high-voltage equipment is to relatively low-tech assault. More recently, attacks on substations in North Carolina in 2022 left tens of thousands of customers without power for days, carried out with nothing more sophisticated than firearms.

What the Beryllia exercise added to this picture was the compounding variable: a major international event that concentrates both population and global attention, layered on top of climate-driven demand spikes. Utilities operating in World Cup host cities or in the Los Angeles basin ahead of 2028 are not just managing a grid. They are managing a grid that has become a symbolic and strategic target.

Drones have introduced a particular complication. Unlike a shooter at a fence line, a drone can approach critical equipment from angles that traditional physical security was never designed to address. The exercise's inclusion of drone attacks alongside ballistic and vandalism scenarios reflects a real operational concern that security planners have been raising with increasing urgency. The FAA and Department of Homeland Security have both flagged the growing use of commercial drones in proximity to critical infrastructure, and counter-drone technology remains expensive, inconsistently deployed, and legally complicated to operate in populated areas.

The systems-level danger here extends well beyond the immediate loss of power. When a grid fails during a heat wave, the cascade moves fast. Hospitals switch to backup generation, which is finite. Cooling centers fill beyond capacity. Water treatment and pumping stations lose power, creating public health emergencies that compound the original crisis. Emergency services face surging call volumes precisely when their communications infrastructure is most stressed.

For a city hosting a major international sporting event, the feedback loops become even more tangled. Hundreds of thousands of visitors are present, many unfamiliar with local geography and dependent on digital navigation and communication tools that require power. Hotel and venue backup systems are designed for short outages, not multi-day grid failures. The reputational and economic damage to the host city, and to the United States as a host nation, would extend far beyond the event itself.

There is also a second-order consequence that rarely gets discussed in the immediate aftermath of grid security exercises: insurance and investment risk. If utilities and grid operators are seen as inadequately prepared for foreseeable attack scenarios, the cost of insuring critical infrastructure rises, capital investment in grid modernization becomes harder to finance, and the political pressure to nationalize or federalize grid security grows. The exercise in Beryllia, fictional as it was, is quietly reshaping how risk is priced in a very real market.

The 2028 Olympics will arrive whether the grid is ready or not. The more instructive question is whether the gap between the scenario and the solution is closing fast enough.