Special Investigation: America's Strange 60 Days. Coincidence, or Attacks on America?

Has it felt like everything is breaking at once?

If the last few weeks have felt off to you, you're not imagining it.

Your work email died on Thursday. On Friday afternoon, every plane in America was told to stay on the ground. That evening, people at thousands of companies couldn't get into the system that runs their paychecks. A Walmart in Tennessee was emptied out over a bomb threat. And late that night, police in Peoria, Illinois, found an actual bomb at an ethanol plant and moved more than five thousand people out of their homes.

That was a day and a half.

Rewind sixty days and it doesn't stop. Hospitals knocked offline. Schools where hackers took over the door locks. A city government shut down. Supermarket freezers cooked from the other side of the world. Foreign hackers inside small-town water systems. Bomb threats traced overseas and fake gunman calls. Drones over American air bases. A plot to send vans of fuel to a base full of American planes.

Any one of those, on its own, you'd read and forget by lunch. Stack them up and you start to wonder. Is this a run of bad luck? Or is somebody hitting us, a little at a time, while nobody in charge wants to say so out loud?

We spent two days digging through every incident we could confirm. This is what we found.

The pile-up, week by week

It starts in late August, when someone overseas got into two small water systems in Colorado, switched off their alarms and messed with how the pumps ran. The public didn't hear about it until September 18. Nobody has said who did it, though the state pointed at Iranian-backed hacking aimed at American water.

On September 27, police in England stopped three suspicious vans heading toward RAF Fairford, a British base that houses American military planes. Remember that one. It comes back later.

On October 1, ransomware hit the city of Vicksburg, Mississippi, and the city had to shut down its computer systems. Police, fire and 911 kept running while the rest was rebuilt.

On October 11, Ahold Delhaize, the company behind Food Lion, Stop and Shop, Giant and Hannaford, had a cyber incident on its network. It pulled its websites and apps. Online orders and deliveries stopped for about a week. To this day nobody has said publicly who was behind it.

That same weekend in France, hackers got into the refrigeration controls at about seven hundred supermarkets and turned up the heat. Food rotted. At least fifteen fires broke out.

On October 17, hackers hit the Jerome School District in Idaho and took over the security cameras, the electronic door locks and the heating and cooling in eight schools. Classes were canceled for two days. Think about that one for a second. Somebody you'll never meet had control of the doors at your kid's school.

On October 21, Richmond Public Schools in Virginia took its whole network offline after a cyberattack. Phones and email went down. Weeks later, the district admitted some of the personal information stolen in the attack had turned up on the dark web.

On October 22, University Hospitals in Cleveland, a system of twenty-one hospitals, found a cybersecurity incident and pulled its digital services, including the patient portal people use to see their records and message their doctors. Two weeks later, it still couldn't say when everything would be back.

On November 2, supermarket cooling systems failed across Belgium, and stores in eight more European countries reported the same kind of trouble.

By November 3, one high school in Pennsylvania had received eight bomb threats since the end of August. When police finally ran them down, every one came from outside the United States.

On November 9, a hospital in Ridgecrest, California, lost its phones and computers in a cyber incident, and its pharmacy stopped filling prescriptions. The same day, France said out loud who wrecked its supermarket freezers: a hacking unit tied to Iran's Revolutionary Guard. A ransomware gang also claimed it had broken into Vanderbilt University in Nashville.

On November 10, federal prosecutors in New York charged three men tied to Iran's Revolutionary Guard and an Iraqi militia over nearly twenty attacks and attempted attacks, many of them aimed at Jewish communities, both over there and here at home. Prosecutors say the group sent vans, some of them loaded with barrels of fuel, toward RAF Fairford to blow up at the base. Those were the vans police stopped at a roadblock in September. One of the three was already sitting in an American jail, and prosecutors say he kept helping coordinate from behind bars. Days later, American bases in Britain were raised to the second-highest threat level.

On November 11, a caller told police there was a man with guns and pipe bombs in an auditorium at the University of Illinois. There wasn't. Police believe the call came from somewhere else entirely. The FBI has warned this year that these fake emergency calls are shifting away from individual people and toward schools, hospitals and government buildings, with the aim of disrupting them or spreading fear. That same day, more than six thousand schools in Italy got bomb threats.

On November 12, Microsoft's email and Teams went down around the world and stayed shaky for more than a day. Airlines lost their internal email in the middle of it.

And on November 13, it all seemed to land at once. The FAA grounded every departing flight in the nation for a little over four hours after radar and radio trouble at air traffic control centers. More than forty-seven hundred flights were canceled. Workday's payroll and time clock system crashed. The Walmart in Ashland City was evacuated. Drones were reported over an American air base in England. And in Peoria, the bomb.

That's a lot of smoke for sixty days.

The case for coincidence

Let's be fair to the boring explanation first, because it might be the right one.

Every company in the biggest outages has given a reason, and none of them says attack. Microsoft says a network upgrade went sideways. The FAA blames worn-out air traffic equipment that couldn't handle the load, and anyone who has followed that system knows it's held together with tape. Workday says a test of its own backup system went wrong and scrambled live data. The Walmart threat was a phone call, and the store reopened within hours.

A lot of the ransomware on that list is the work of criminal gangs chasing money, not soldiers following orders. They hit schools and hospitals every year, war or no war. And some of what happens in any sixty days is plain accidents. In that same stretch, a train hit a truck and derailed in Alabama, and a feed mill in Iowa had two explosions. Nobody thinks Iran did that.

Big systems fail more often than people realize. We just don't usually notice them all in the same week. And once you go looking for a pattern, you'll find one whether it's there or not.

The case for attacks

Here's the problem with stopping there. America is at war with Iran right now. And Iran has already shown it can do exactly this kind of thing.

The freezer attacks in Europe weren't a rumor. Two governments point at Iran, and France has issued arrest warrants. Reporting this week says those hackers got in through weak spots in control equipment that is also used in stores and plants here in the United States. Since spring, America's own cyber agencies have warned that hackers tied to Iran's Revolutionary Guard are breaking into equipment across several American industries, with the goal of causing disruption inside this country. By September, Iranian hackers had been caught trying to get into American phone networks and power companies.

The bomb plots aren't a rumor either. A federal grand jury says an Iran-backed network went after nearly twenty targets, some of them here, and sent vans of fuel toward a base full of American planes.

Then look at what Washington is doing, not just what it's saying.

On September 30, the Pentagon quietly set up a program called FORTRESS America. Its job is to keep the military running if cyberattacks and sabotage take down power grids and factories here at home. Big bases are being told to plan for about ninety days without the civilian grid. The Defense Secretary says every base on American soil is getting toughened up against saboteurs and drones. One defense expert told Fortune it's the kind of planning the country hasn't seen since the Cold War.

According to The Intercept, a secret intelligence memo on October 23 warned that Iranian plots to kill Americans had reached advanced stages. The Treasury Secretary has moved out of his house and onto a military base because of Iranian death threats, and reports say the Defense Secretary and the Secretary of State are living on bases too. And the Pentagon won't tell the public what Iran's strikes on our bases overseas have already cost. That number was only shared in a classified briefing.

Now go back to the "no cyberattack" statements. Officials ruled out an attack on the air traffic system within hours, before anyone could have finished looking. The Homeland Security Secretary said there was no evidence of an attack, and in the same breath admitted they couldn't rule one out. Microsoft first said it found no recent change tied to its outage, then said it was rolling one back.

Maybe all of that holds up. But this week we wrote about the Gulf of Tonkin, where it took forty years for the public to learn that one of the attacks used to sell a war never happened. The first story out of Washington isn't always the last one, especially in wartime.

So which is it?

The honest answer is that nobody outside the government can prove it either way right now, and we won't pretend we can. No one has publicly tied the Microsoft outage, the grounded planes, the payroll crash, the hospital hacks or the Peoria bomb to each other, or to Iran. Nobody has published numbers showing these sixty days are worse than any other sixty days, either.

But we don't buy that it's nothing.

We're in a shooting war with a country that is already hacking American equipment, already wrecking food supplies in Europe, already plotting bombings against Americans, according to a federal grand jury, and already threatening American officials, according to our own intelligence people. The Pentagon is preparing for sabotage on American soil. Cabinet members are sleeping behind fences. And in the middle of all that, the systems we depend on keep falling over, one after another, and every time the first answer is "nothing to see here."

Maybe it's coincidence. Maybe some of it is and some of it isn't. Either way, it's a fair question, and the people asking it aren't crazy. Somebody in Washington owes the country a straight answer. What was in that classified briefing? Why are bases being told to plan for ninety days off the grid? How do you rule out an attack before the investigation is even finished? And who put a bomb at an ethanol plant in the middle of Illinois?

What to do while we wait for answers

Whether it was Iran, a criminal gang, a bad router or a botched test, it looks the same from your kitchen. The screen goes dark, the card doesn't go through, the flight doesn't leave, the paycheck doesn't show up, the doctor's office can't pull your records.

So get ready for that, not for one particular villain. Keep some cash in the house, because payroll and card systems can go down on the same day. Keep paper copies of your last few pay stubs, your prescriptions and the phone numbers you'd actually need. Keep at least a couple of weeks of any medicine you can't go without, because a hacked pharmacy can't fill it. Keep your tank at least half full and a couple of weeks of the food your family really eats. Get a battery or hand-crank radio so you can hear the news when the internet can't. And if you live near a refinery, a chemical plant or anything like that ethanol plant in Peoria, know two ways out of your neighborhood and where you'd go.

Then keep watching. We will. If the next sixty days look like the last sixty, coincidence is going to get harder and harder to believe.