When Power Goes Out, Cyber Risk Goes Up: What the Venezuela Outages Really Teach Us
In early January, reports surfaced that Venezuela experienced widespread power and internet outages just ahead of a U.S. military operation. Within hours, headlines and social media threads were buzzing with a dramatic theory: a cyberattack had taken down the grid. The idea was irresistible. After all, cyber operations are invisible, deniable, and increasingly associated with modern conflict.
But as is often the case in cybersecurity, the truth was both less sensational—and far more instructive.
In a recent episode of CyberSide Chats, we unpacked what actually happened, why the “cyberattack” narrative spread so quickly, and what organizations should learn from moments like this. The takeaway wasn’t about geopolitics. It was about fragility, trust, and what happens to security controls when infrastructure is stressed.
Because whether the trigger is a military operation, a natural disaster, or a regional outage, the cyber risks that follow are remarkably consistent.
Rumors Travel Faster Than Packets
The speculation around Venezuela didn’t come out of nowhere. During a press conference, former President Trump remarked that “the lights of Caracas were largely turned off due to a certain expertise that we have.” Around the same time, comments referencing layered effects from SpaceCom and CyberCom fueled the idea that a cyber operation had disabled Venezuela’s infrastructure.
From there, the rumor mill took over.
Technical observers began pointing to anomalies in Border Gateway Protocol (BGP) routing—specifically involving Venezuela’s state ISP, CANTV. BGP, after all, determines how traffic flows across the internet. If routes are misconfigured or hijacked, traffic can be delayed, dropped, or misdirected entirely.
But correlation is not causation.
Cloudflare quickly analyzed the data and responded publicly. Their conclusion was clear: while routing anomalies existed, they were consistent with misconfiguration—not malicious interference—and similar issues had occurred multiple times in recent months.
As we discussed on the podcast, this kind of misattribution is common. As one host put it, “It’s very dramatic to think about hackers breaking in and taking things down—but most of the time, that’s not the reality.”
The Much Less Exciting (and More Likely) Explanation: Kinetic Effects
So what likely caused the outages?
The timing of the power failures and internet disruptions strongly suggests kinetic effects—physical impacts that cascade into digital systems. In other words: when power infrastructure fails or is damaged, everything upstream and downstream feels it.
“Outages were consistent with kinetic effects,” Sherri Davidoff noted, “Strikes, explosions, or force shutdowns that disrupt systems through physical damage, not hacking.”
This isn’t unique to Venezuela. Even in countries with robust infrastructure, taking down a power substation can ripple outward, knocking out ISPs, cellular networks, and identity services. In environments with aging or fragile infrastructure, the effects are amplified.
The lesson here isn’t about BGP or geopolitics. It’s about dependency chains—and how quickly cyber risk escalates when physical systems fail.
Why Big Events Create Prime Conditions for Cybercrime
While analysts debated root causes, attackers wasted no time exploiting the moment.
Major news events reliably create fertile ground for cybercrime. Confusion, urgency, and emotional response lower defenses. We see phishing emails themed around donations, emergency access, free services, and “exclusive” information appear within hours of breaking news.
In this case, warnings soon followed—including from U.S. government sources—about heightened cyber activity and the risk of retaliatory or copycat attacks by hacktivist groups and nation-state actors.
As we noted during the episode, “Any big news is a big opportunity for cybercriminals.”
This pattern mirrors what we’ve seen after conflicts involving Iran, Ukraine, and other geopolitical flashpoints. Even when the affected country isn’t launching cyber operations itself, sympathetic or opportunistic actors step in.
For organizations watching from afar, the risk isn’t theoretical. It’s operational.
When Infrastructure Fails, Identity Fails Too
One of the most overlooked consequences of outages—whether cyber or physical—is what happens to identity and authentication systems.
“Assume your identity controls will degrade under stress, “Matt Durin emphasized. If MFA relies on SMS, push notifications, or external identity providers, those systems may be unavailable or unreliable during an outage.
In emergencies, people make expedient choices:
- MFA gets bypassed “temporarily”
- Insecure networks get used “just for now”
- Emergency access accounts are dusted off—if anyone remembers how they work
These decisions are understandable. They’re also dangerous.
Organizations should plan for identity disruption the same way they plan for network outages. That means defining emergency authentication procedures in advance and testing them regularly—not discovering gaps during a real incident.
LMG Security regularly helps organizations identify these weaknesses through tabletop exercises and identity-focused assessments, because these failures almost never show up in routine testing.
Crisis Communications Are a Security Control
Another critical lesson from Venezuela—and from nearly every major outage—is the importance of pre-approved crisis communications.
When systems are down, that is the worst possible time to decide who can speak, what can be said, and how messages will be delivered. Internal confusion quickly becomes external misinformation.
“You want to control the narrative,” Sherri Said, That means:
- Pre-drafted internal and external communication templates
- Clear authority for who approves messaging
- Alignment between security, legal, PR, and leadership
Many cyber insurance policies and legal partners can help organizations prepare this language in advance—but only if it’s part of the planning process, not an afterthought.
Treat Every Major Outage as a Security Incident
One of the most important takeaways from this case study is deceptively simple:
Treat any major disruption as a security incident, even if you don’t know the cause yet.
Whether the trigger is a misconfiguration, a physical failure, or something more sinister, outages create opportunities for attackers. They also force rapid decision-making under pressure, which is when controls are most likely to be bypassed.
As we summarized during the episode:
- Expect phishing and scams tied to breaking news
- Expect identity controls to weaken
- Expect misinformation to spread faster than facts
The organizations that fare best aren’t the ones with perfect tools. They’re the ones that have practiced making decisions when information is incomplete.
Test Decisions, Not Just Tools
A recurring theme in our tabletop exercises is that teams often assume decision-making will “just happen” during a crisis. In reality, uncertainty, limited communication, and unclear authority slow everything down.
“Test your decision-making under pressure, not just your tools,” Sherri said.
Who can make a call if systems are down?
What happens if key leaders are unreachable?
What risks are acceptable in the first hour versus the first day?
These are governance questions as much as technical ones and they’re central to cyber resilience.
Turning Insight Into Action
The Venezuela outages weren’t primarily a cyberattack story. They were a reminder of how fragile modern systems are—and how quickly cyber risk escalates when infrastructure, identity, and communications collide under stress.
If your organization hasn’t recently tested:
- Identity access during outages
- Crisis communications workflows
- Executive decision-making under pressure
…it’s worth doing so before the next “unexpected” event forces the issue.
LMG Security helps organizations prepare for exactly these scenarios through tabletop exercises, risk assessments, and advisory services designed to test real-world decision-making—not just technical controls. If you want to explore how your organization would respond under pressure, we’d be happy to help you stress-test those assumptions.
