At 02:09 on 14 March the Calder substation, which serves the eastern half of Brant County, went dark. Power was restored at 08:21. Roughly 11,400 customers were affected.
At 02:49, forty minutes into the outage, the utility's operations chief told a local broadcaster that the county had been hit by “a sophisticated cyberattack.” No log review had begun at that point. The claim was repeated by three regional outlets within the day and by a national aggregator the following morning.
You have been asked to look into it. The file below is what exists. Work the cycle: commission the question, baseline what is established, lay out the hypotheses, verify what can be verified, and write a finding you can defend.
Exhibits
SCADA event log
Breaker B-4 opened 02:09:14. No operator command recorded in the preceding six hours. Restoration sequence begins 07:52.
Asset register
Breaker B-4 installed 1995. Two prior in-service failures recorded, 2019 and 2023. Replacement deferred in the last two budget cycles.
Network audit, 5 February
Control network verified physically isolated from the business network and from the internet. Two findings, both administrative, both closed.
Perimeter firewall alert
02:58 alert matching a published indicator list. The same rule fired 31 times in the preceding 30 days.
Badge and gate records
Vendor crew signed out 01:40. Substation door opened from the inside at 02:14 by badge 4471. The badge system's clock runs 11 minutes fast against the reference.
Gate camera log
Fixed camera over the substation door, clock 4 seconds slow against the reference. 02:02:56 camera time (02:03:00 reference): the door opens from the inside and one person stands in the doorway, face and hands not visible. 02:04:10 camera time: the door closes. The camera does not view the breaker bay.
Vendor work log
Routine breaker maintenance completed 01:35, self-reported, signed by the crew lead.
Weather and strike data
No recorded lightning within 40 km. Clear, 11°C, wind 6 km/h.
Post-incident inspection
Mechanical wear on the operating mechanism consistent with age. No evidence of an electrical command sequence at the failure.
Social post, 02:31
Photograph captioned “Calder going up right now.” Reverse image search returns the same photograph on a 2021 page about a fire in another state.