Energy and Utilities Incident Cost: NERC CIP, Colonial Pipeline, Water Sector in 2026
Energy and utilities incident cost averages $5.24M per breach in IBM CODB 2026 (up from $4.83M in 2025), but the operational-disruption math (the OT layer) and the regulatory math (NERC CIP for bulk power, TSA pipeline directives, EPA water-sector guidance) make this one of the most heavily regulated incident-cost regimes in any industry. The Colonial Pipeline 2021 event reset US federal expectations on critical-infrastructure cyber, and the cumulative regulatory cost since then has materially exceeded the direct cost of the incident itself.
NERC CIP Penalty Math
NERC Critical Infrastructure Protection (CIP) standards apply to entities that own or operate the bulk power system in North America. Penalty authority derives from Federal Power Act section 215 (16 USC 824o), under which FERC certifies NERC to enforce the standards, and the penalty ceiling comes from section 316A (16 USC 825o-1). The statute set the maximum at $1,000,000 per violation per day; FERC's annual inflation adjustment puts it at $1,584,648 per violation per day, the figure in force since 14 January 2025 (18 CFR 385.1602, Order No. 906). NERC publishes every filed penalty in its enforcement actions spreadsheets.
| Settlement | Year | Penalty | Notes |
|---|---|---|---|
| Unnamed entity (press: Duke Energy) | 2019 | $10M | 127 CIP violations; the largest CIP penalty at the time |
| Unnamed entity (press: PG&E) | 2018 | $2.7M | Critical-asset data left exposed online by a contractor |
Beyond direct penalties, CIP compliance carries a standing overhead that no public source totals, so budget it from your own registration scope. The cost includes documentation, audit preparation, control evidence collection, change-management tracking under CIP-010, and access reviews under CIP-004. CIP-013 (supply-chain risk management) added meaningfully to the compliance cost when it became enforceable in October 2020.
The Colonial Pipeline Cost Stack
The Colonial Pipeline DarkSide ransomware event in May 2021 is the best-documented critical-infrastructure cyber incident in the US, but Colonial never published a total cost. What the public record does contain:
| Cost Component | Amount | Notes |
|---|---|---|
| Ransom paid | $4.4M (about 75 BTC) | Amount per Colonial CEO Senate testimony, June 2021; bitcoin count per DOJ |
| Ransom recovered | 63.7 BTC (over $2.3M) | Seized by the Department of Justice, June 2021 |
| Operational disruption | Not disclosed | About six days of shutdown on a pipeline Colonial describes as 5,500 miles long |
| Response, rebuild and TSA compliance | Not disclosed | No figure published by Colonial |
The wider cost fell on fuel buyers and retailers across the Southeast rather than on Colonial, and no one has published a sourced total for it. That pressure produced the TSA Pipeline Security Directives and fed into the May 2021 Executive Order on Improving the Nation's Cybersecurity (EO 14028).
Water Sector: Under-Funded, Increasingly Targeted
The US water sector comprises approximately 50,000 community water systems, the vast majority of which are small municipal utilities with minimal IT staff and effectively no cybersecurity budget. The sector has been targeted increasingly since 2021 by both criminal and state-affiliated actors. The economic incident-cost impact is small per individual utility (most events end in a few-hundred-thousand-dollar response cost) but the public-trust externality is large.
| Incident | Year | Method | Disclosed Impact |
|---|---|---|---|
| Oldsmar, FL water treatment | Feb 2021 | Insider credential / RDP-style access | Brief sodium-hydroxide setpoint manipulation; quickly reverted; minimal direct cost |
| Aliquippa, PA water authority | Nov 2023 | Israeli-made Unitronics PLC compromise (CyberAv3ngers) | Booster station offline; manual override; no service interruption |
| North Texas Municipal Water District | Nov 2023 | Daixin ransomware | Customer billing affected; service uninterrupted |
| Veolia North America | Jan 2024 | Ransomware | Back-end systems affected; no customer-water-quality impact |
| American Water Works | Oct 2024 | undisclosed | Customer portal offline; service uninterrupted; investigation ongoing |
None of the incidents above came with a published dollar cost, so this page does not state a typical one. The cost that is visible is regulatory: EPA water-sector cybersecurity guidance and the America's Water Infrastructure Act requirement for risk and resilience assessments. Budget a utility's own exposure from its system count and staffing rather than from a sector average that does not exist.
Per-Hour OT Downtime in Energy
Per-hour generation and distribution downtime cost is the central operational incident-cost metric for energy. No public source publishes it per asset, so the table below gives the formula to run with your own figures rather than a dollar band.
| Asset Type | Per-Hour Cost Formula | Where the inputs come from |
|---|---|---|
| Gas or nuclear generation | MW offline x hourly price for replacement power | Your ISO/RTO day-ahead or real-time price; EIA wholesale price data |
| Oil refinery unit | Barrels per hour lost x crack spread | Unit throughput; published crack-spread benchmarks |
| LNG export terminal | Cargo delay or cancellation terms | Your offtake contracts |
| Pipeline transport | Barrels not shipped x tariff | Your filed tariff and nominations |
| Distribution utility | Customer-hours of interruption x value you assign | Your outage management system |