Coordinated ranged attack on Metcalf transmission substation near San Jose
2013Published 1 May 2026Responsible editor: Chief Editor
- Where
- Metcalf transmission substation near San Jose, California
- Operator
- Pacific Gas and Electric
- What
- Rifles fired at site from outside fence, 17 transformers struck
- Injuries
- None reported
- Outcome
- Damaged units taken out of service, supply rerouted
Get the next one by email
Free alerts on grid infrastructure incidents in the United States, and an email when EIR-0020 is updated. No account needed; unsubscribe in one click.
Confirm your email and every substation and transformer incident on the register arrives at once as a spreadsheet (CSV), free.
Get a free sample brief Three complete verified records and the incidents-per-GW table, by email within a minute.
We will also email you about the register's paid records and plans, at most once a week and three times in all. You can stop these at any time. By signing up you agree to the privacy policy.
Companies named in the reporting of this entry (being named is not a finding of fault): Pacific Gas and Electric
What happened
In April 2013, the Metcalf transmission substation near San Jose, California, operated by Pacific Gas and Electric, was attacked by one or more people firing rifles at the site from outside the perimeter fence. Public reporting stated that around 17 transformers were struck, causing oil leaks and overheating, and that the damaged units were taken out of service. Grid operators rerouted supply and no injuries or widespread customer outage were reported.
The incident was investigated by federal law enforcement and was followed by federal regulatory action requiring a mandatory physical security standard for critical bulk electric system facilities. It is widely cited as a case study of deliberate physical attack risk to transmission assets.
Contributing factors
Public reporting and the subsequent regulatory record indicate that the substation equipment behaved as designed once damaged, with leaking transformers taken offline, and that the significance of the event lay in the security assumptions it exposed. Factors reported were: (1) the perimeter was designed principally against trespass and theft rather than sustained attack from outside the fence line; (2) the site was reachable from public roads and had nearby natural cover; (3) detection systems were not intended to identify or locate an attack originating outside the perimeter; (4) communications cables in the vicinity were reported to have been cut shortly before the attack on the transformers, suggesting prior planning; (5) reported response times indicated that intervention during an attack of this duration would have been unlikely even with faster detection.
Lessons learned
- Review sightlines and natural cover around critical substations, since attack from outside the fence line must be considered in threat assessments.
- Protect and duplicate site communications routes, so loss of cables does not disable detection and response.
- Test detection systems against scenarios that begin outside the perimeter, and agree realistic response times with emergency services.
More lessons on theft, arson and site security, detection and monitoring, from every incident on the register.
Not yet known
- Exact cause of transformer damage beyond rifle strikes
- Downtime and cost of repairs
- Transformer models and ages
This entry is updated when these are reported. Get an alert for the next one like it.
Source
Published 2026-05-01. Written from public reporting. Descriptive, not investigative. See the data accuracy disclaimer.
