Infrastructure · Sep 11, 2026FirstEnergy: Tens of Thousands of Attacks Blocked Each Month

KEMETIC MINDS
Infrastructure Watch — Daily Update — September 11, 2026

---

FirstEnergy Pennsylvania’s defensive systems block tens of thousands of automated malicious connection attempts against its public-facing services every month, the company’s chief security officer told a panel of state lawmakers.

The testimony came as Pennsylvania House members weigh whether utilities need new cybersecurity requirements — and who should pay for them.

• FirstEnergy Pennsylvania serves 2.1 million electric customers across 56 counties and says it blocks tens of thousands of automated malicious connection attempts each month (New Hope Free Press, 2026).
• Rep. Pat Gallagher (D-Philadelphia) said attackers aim to “manipulate, disrupt or disable the very control systems that provide light, heat and clean water for our communities” (New Hope Free Press, 2026).
• Craig Fahnestock of the Pennsylvania Municipal Authorities Association said cybersecurity “now competes for the same limited resources needed for pipes, pumps and capital improvements” (New Hope Free Press, 2026).
• His association represents nearly 700 municipal water authorities, many of them small (New Hope Free Press, 2026).
• Utility executives and experts agreed the spending is nearly as necessary as infrastructure investment — but warned the cost lands on ratepayers (New Hope Free Press, 2026).
• No confirmed breach, outage or lost service was described in the hearing account (New Hope Free Press, 2026).

1. FirstEnergy Blocks Tens of Thousands of Attacks a Month

What the company told lawmakers

Brian Harrell, chief security officer at FirstEnergy Pennsylvania, said his company’s defenses block tens of thousands of automated malicious connection attempts against public-facing services each month (New Hope Free Press, 2026).

“These statistics underscore why cybersecurity requires constant attention and continual enhancement,” Harrell told the panel (New Hope Free Press, 2026).

The utility serves 2.1 million electric customers across 56 counties, according to the account of the hearing (New Hope Free Press, 2026).

Attackers are going after control systems, not billing pages

Rep. Pat Gallagher (D-Philadelphia), who chairs the House Consumer Protection, Technology and Utilities Committee’s subcommittee on utilities, said the targets are the systems that keep the lights and water running (New Hope Free Press, 2026).

“They’re seeking to manipulate, disrupt or disable the very control systems that provide light, heat and clean water for our communities,” Gallagher said (New Hope Free Press, 2026).

He called for a “unified front, one that bridges private operators, public regulators, state agencies and both political parties” (New Hope Free Press, 2026).

The money problem: security now competes with pipes and pumps

Utility executives and cybersecurity experts agreed that cybersecurity investment has become nearly as necessary as spending on physical infrastructure (New Hope Free Press, 2026).

But they told lawmakers those dollars come out of ratepayers’ pockets, and asked that any new regulations or requirements take that into account (New Hope Free Press, 2026).

Craig Fahnestock, the Pennsylvania Municipal Authorities Association’s director of government relations, put the tradeoff bluntly: “These investments are necessary, but cybersecurity now competes for the same limited resources needed for pipes, pumps and capital improvements” (New Hope Free Press, 2026).

“We’re asking for requirements that are achievable,” he said (New Hope Free Press, 2026). His group represents nearly 700 municipal water authorities, many of them on the smaller side (New Hope Free Press, 2026).

Why small systems are the hard case

The pressure is not new. In recent years, criminal and state-sponsored actors have increasingly targeted critical infrastructure across America and Europe, according to the account given to lawmakers (New Hope Free Press, 2026).

As utilities and grid infrastructure rely more on internet connections to function, the tools available to attackers have grown more sophisticated (New Hope Free Press, 2026).

The testimony echoes other recent utility cyber incidents, including the Stadtwerke Landsberg cyberattack that knocked city phones offline.

What a small water authority with few staff can realistically afford is the question the panel did not resolve. The article by Ian Karbal of the Pennsylvania Capital-Star, published by New Hope Free Press, describes no bill, no vote and no deadline (New Hope Free Press, 2026).

---

What’s Disputed or Unconfirmed

The attack-volume figure — tens of thousands of blocked connection attempts per month — is FirstEnergy’s own number, presented by its own security chief. No independent regulator or third party has verified it in this account (New Hope Free Press, 2026).

No confirmed breach, outage, or affected customer was described. The testimony concerns blocked and attempted intrusions, not successful ones (New Hope Free Press, 2026).

The statement that criminal and state-sponsored actors are behind the targeting is a general characterization of the threat landscape, not tied in this account to a named group, a specific incident, or an open investigation (New Hope Free Press, 2026).

The cost warning comes from parties with a direct stake: a utility and an association representing municipal water authorities that would bear new requirements. Their position is one side of a funding debate, not an adjudicated finding (New Hope Free Press, 2026).

---

🛡️ Free Preparedness Guides

Two free, printable checklists you can download and keep on hand — one for water-supply disruptions, one for power outages.

---

References

1. New Hope Free Press. (2026, September 10). Cyberattacks On PA Power & Water Utilities Prompt Call For Action. newhopefreepress.com

---