What happened

The SolarWinds Orion supply-chain compromise reached business networks at the U.S. Department of Energy, including the National Nuclear Security Administration, and affected the Federal Energy Regulatory Commission. DOE said the malware was isolated to business networks and did not affect mission-essential national-security functions; no grid control or generation disruption was reported. The incident exposed sensitive government and regulatory environments, but the supplied claim that attackers obtained a complete 'roadmap' of U.S. grid vulnerabilities is not stated as fact.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.