Glossary term
Data breach
A data breach is an event where someone gets access to information they are not authorized to see, or where authorized users use it for a purpose they were not allowed.
Read more
Significant cyber incident
Mumbai power outage and cyber sabotage claim, 2020
On 12 October 2020 a widespread power outage hit Mumbai and its suburbs, stopping trains and delaying exams.
In short
On 12 October 2020 a widespread power outage hit Mumbai and its suburbs, stopping trains and delaying exams. In March 2021 Maharashtra's Energy Minister said, on preliminary information, that a cyber attack and sabotage were behind it. The Union Power Minister later said teams found human error, and a panel found no conclusive evidence of a cyberattack. The cause is therefore disputed.
What happened
On 12 October 2020 a widespread outage hit Mumbai, according to Business Today. It affected train services, delayed exams and caused traffic jams. The Union Power Minister said about 2,000 MW went off and about 1,900 MW had been restored by the evening, and that the national grid was fine. Mumbai airport, BSE and NSE reported outages but said operations continued normally. Maharashtra’s Energy Minister said power to essential services had been restored, and that the failure was first said to be caused by technical problems during maintenance. He ordered a probe.
Energetica India reported that a team led by the Central Electricity Authority would study the breakdown. It also noted that Mumbai is supplied under an islanding system, which is meant to insulate the city from failures in the wider grid. The Hitavada later reported that islanding failed to work that day.
On 1 March 2021 the Maharashtra Energy Minister said there definitely was a cyber attack and it was a sabotage, as reported by PTI through The Tribune. He cited preliminary information, said separate committees had been set up and that the cyber cell report was awaited, and did not share more details. The Tribune noted that a US company’s report claiming a China-linked group had targeted India’s power grid raised suspicion about the outage. A BJP leader, a former state energy minister, said the claim lacked proof and pointed to two lines already being down before the tripping.
The Union Power Minister answered on 2 March 2021. He said two teams investigated and submitted that the outage was caused by human error and not by a cyber attack. One team found that cyber attacks did happen but were not linked to the Mumbai grid failure. He said there was no evidence that the attacks were carried out by China or Pakistan. On 22 July 2021 he told the Rajya Sabha that no conclusive evidence was observed to attribute the Mumbai grid incident to a cyberattack. Sources differ on the cause; no official account in the sources opened confirms a cyber cause.
Timeline
-
12 October 2020
A widespread outage hits Mumbai and nearby areas. Train services, exams and traffic are affected (Business Today).
-
12 October 2020
The Union Power Minister says about 2,000 MW went off and about 1,900 MW has been restored. The Maharashtra Energy Minister says the cause was technical problems during maintenance and orders a probe.
-
13 October 2020
Energetica India reports that a central team led by the Central Electricity Authority will study the breakdown.
-
November 2020
BOOM later reports that the Maharashtra cyber department reportedly suspected malware attacks from China.
-
1 March 2021
The Maharashtra Energy Minister says there definitely was a cyber attack and it was sabotage, citing preliminary information.
-
1 March 2021
BOOM reports that the Indian government and power companies have yet to give a statement.
-
2 March 2021
The Union Power Minister says two teams found human error and not a cyber attack. One team found that cyber attacks did happen but were not linked to the Mumbai failure.
-
3 March 2021
A BJP leader says the cyber attack claim lacks proof and points to two lines already down before the tripping (The Hitavada).
-
3 March 2021
T&D India quotes the minister: malware attempts hit northern and southern load dispatch centers but could not reach the operating system.
-
22 July 2021
The Union Power Minister tells the Rajya Sabha a panel found no conclusive evidence to attribute the Mumbai incident to a cyberattack.
How the attack worked
No official account in the sources opened describes a method for a cyber attack on the Mumbai grid. This section sets out the two accounts and what each says.
The account of a cyber cause
The Maharashtra Energy Minister said on 1 March 2021 that, on preliminary information, a cyber attack and sabotage occurred. He gave no method. T&D India quoted the Union Power Minister as saying the Maharashtra Home Minister had informed that cyber attacks happened on the SCADA system in Mumbai. BOOM reported that the state cyber department reportedly suspected malware attacks from China. These are statements by officials or reports of suspicion, not a published technical finding.
The account of a non-cyber cause
The Union Power Minister said two teams found human error. The Hitavada reported that islanding failed to work and that the four lines supplying the city tripped, and a BJP leader said two lines were already down two days before. In the Rajya Sabha on 22 July 2021 the minister said no conclusive evidence supported a cyber cause.
Cyber attempts on other grid sites
The July 2021 reply listed cyber incidents at four regional load despatch centers, NTPC Kudgi and Telangana State Transco, with isolation and protective measures taken. The Union Power Minister said earlier that the malware could not reach the operating system. These are separate from the Mumbai outage; the minister said they were not linked to it.
Who says who was behind it
No attribution to a state or group by the Indian government. The Union Power Minister said there was no evidence the cyber attacks were carried out by China or Pakistan (The Quint, 2 March 2021).
Reported by BOOM, 1 March 2021: the Maharashtra cyber department reportedly suspected malware attacks from China in November 2020. This is a report of suspicion, not an attribution.
Reported by The Tribune, 1 March 2021: a US company's report claiming a China-linked group targeted India's power grid raised suspicion about the outage. The company is not named here and the report was not used as a source.
Impact
Power: about 2,000 MW went off and about 1,900 MW had been restored by the evening of 12 October 2020 (Union Power Minister, Business Today).
Services: train services, exams and traffic were affected. Mumbai airport, BSE and NSE reported outages but said operations continued normally.
Data: the Power Ministry said no data breach or data loss was detected from the related cyber incidents, and no impact on POSOCO functions.
Cause: disputed. See the FAQ for the competing accounts.
Government and regulator response
- 12 October 2020: power to essential services was restored by evening. The Maharashtra Energy Minister ordered a probe, and the Union Power Minister said a team led by the Central Electricity Authority would study the breakdown.
- 1 March 2021: the Maharashtra minister said the state government, MERC and the CEA had set up separate committees, and that the cyber cell report was awaited.
- 2 March 2021: the Union Power Minister said two teams found human error, and that cyber attacks on load despatch centers did not reach the operating system.
- 22 July 2021: the Rajya Sabha reply said a panel found no conclusive evidence of a cyber cause, and that affected organizations took isolation and protective measures. The ministry has set up six Computer Emergency Response Teams for the power sector.
- 2024: a Ministry of Power reply published by PIB says GRID-INDIA set up a Security Operation Center across the regional and national load despatch centers, and that 30 of 35 State Load Despatch Centres had cyber security audits.
Lessons
-
Keep your cause statement honest
Within a few months officials gave a cyber cause, a human error cause and no conclusive evidence. Say what is known and what is not.
-
Test fail-safes
Mumbai is supplied under an islanding system, which reportedly failed to work that day. Test protection schemes under real conditions.
-
Share findings early
The state minister gave a cyber cause five months later without detail. Publish what the investigation found, even if it is short.
-
Separate probes need a common record
State, regulator and central committees each looked at the outage. Agree a shared timeline and logs.
-
Monitor control centers
Cyber attempts were reported at load despatch centers. A security operations center across all of them helps tell attempts from causes.
What to check in your own organization
-
Fail-safe tests
Confirm protection and islanding schemes are tested and that results are kept.
-
Log retention
Keep SCADA and network logs long enough to support an inquiry months later.
-
Cyber or not
Define in advance how a team rules a cyber cause in or out, and who signs it off.
-
Segregation
Check that control networks are separate from corporate IT, and that remote access is controlled.
-
Joint inquiries
Agree how state, regulator and national teams share evidence.
-
Reporting
Know your duty to report incidents to CERT-In and the sector team CSIRT-Power.
-
Public statements
Name one owner for public statements about the cause.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country India India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025. Asia Pacific
Questions
What happened in Mumbai on 12 October 2020?
A widespread power outage hit the city and its suburbs. About 2,000 MW went off, and most was restored the same day.
Was it a cyber attack?
Sources differ. The Maharashtra Energy Minister said on 1 March 2021 that there was a cyber attack and sabotage. The Union Power Minister said two teams found human error, and in July 2021 said no conclusive evidence supported a cyber cause.
Who was blamed?
No official attribution. The Union Power Minister said there was no evidence China or Pakistan carried out the cyber attacks. BOOM reported that the state cyber department reportedly suspected malware from China.
Were there cyber attacks on the grid at all?
The Union Power Minister said cyber attacks happened at load despatch centers but did not reach the operating system and were not linked to the Mumbai failure.
What changed afterwards?
The ministry set up six Computer Emergency Response Teams for the power sector, and GRID-INDIA set up a Security Operation Center, according to the sources listed.
Sources
- Mumbai outage: power supply restored in most parts of city Business Today
- CEA-led central team to study Mumbai outage, assist state govt Energetica India
- Cyber attack, sabotage behind 2020 Mumbai power outage: Raut The Tribune (PTI)
- No proof of Chinese hand in Mumbai power outage, says Power Minister R K Singh The Quint
- Mumbai outage October 2020: no evidence of cyber attack, says power minister T&D India
- Bawankule trashes Maharashtra's claim of cyber attack for Mumbai power tripping The Hitavada
- Cyberattacks on four of India's five load despatch units, Centre tells Rajya Sabha Deccan Herald
- China-India cyberattack and the Mumbai power blackout BOOM
- Ministry of Power reply on cyber security of the power grid Press Information Bureau, Ministry of Power
- Industrial Control Systems CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.