US officials: China is ramping up its ability to disrupt key US infrastructure; 2023 victims include a Hawaii water utility, a West Coast port, and a pipeline
A utility in Hawaii, a West Coast port and a pipeline are among the victims in the past year, officials say X: @matt_schrader_ , @ericgeller , @nakashimae , @rc_greenway , and @nakashimae X: Matt Schrader / @matt_schrader_ : Just filling these away as supplementary data points on the question “how does the PRC achieve strategic surprise in a conflict that might potentially require it to execute the largest amphibian invasion in history?” Eric Geller / @ericgeller : More details on Volt Typhoon's activities, which also targeted Texas's independent power grid. And: “The topic of Chinese cyber intrusions into critical infrastructure was on a proposed list of talking points to raise in Biden's encounter with Xi...but it did not come up...” Ellen Nakashima / @nakashimae : The intrusions are part of a broader effort to develop ways to sow panic and chaos or snarl logistics in the event of a U.S.-China conflict in the Pacific, officials said. Robert Greenway / @rc_greenway : And for their efforts we hosted and feted Xi in California. Appeasement breeds aggression. Ellen Nakashima / @nakashimae : NEW: China's cyber army is invading critical U.S. services. PLA hackers have burrowed into about 2 dozen targets over the past year, including a water utility in Hawai, major west coast port & at least one oil & gas pipeline. @josephmenn and me https://www.washingtonpost.com/ ...
Context & Ripple Effects
Officials’ report broadens the earlier warning that Chinese state-sponsored actors had compromised critical-infrastructure organizations across industries, initially characterized as intelligence gathering in Microsoft’s critical-infrastructure disclosure. The named water, port, and pipeline targets make the concern operational rather than confined to conventional espionage.
Subsequent coverage tied the activity to Volt Typhoon: a Five Eyes advisory said the group had maintained access to major US infrastructure for years, and later reporting described breaches of local utilities and sensitive Guam networks. That arc matters because it connects dispersed intrusions to infrastructure relevant to US contingency planning.
First-order effects
- Affected utilities, port operators, and pipeline operators face an immediate need to identify persistence, isolate compromised systems, and coordinate remediation with federal authorities.
- US officials gain a more concrete basis to treat the reported PLA-linked activity as pre-positioning capable of disruption, not solely collection.
Second-order effects
- Other critical-infrastructure owners are likely to reassess remote access, legacy operational technology, and incident-response arrangements, especially where outages could cascade across services.
- The report increases pressure for intelligence sharing between government and privately operated infrastructure, while raising the cost and scrutiny of weak security practices among operators and their vendors.
Third-order effects
- If such access is sustained across sectors, cyber resilience becomes a central component of deterrence and continuity planning: physical infrastructure must be defended as a strategic digital dependency.
- The pattern points toward longer-lived competition over access to civilian networks, where attribution and removal are recurring problems rather than one-time breach-response events.
The trend: This is one data point in the shift from cyber espionage toward strategic pre-positioning in civilian infrastructure that could matter during geopolitical crises.