I hate how this has for some reason been big news the past few days. One mediocre article came out about it, now it keeps getting regurgitated through other news sites. This is nothing new, the US infrastructure has likely been compromised for quite some time. Many of the very critical plants that hold the keys to keeping the lights on, water flowing, water treated, etc are mostly running on systems built pre 2000 that weren't built with security in mind. Many of these systems can not have security integrated with them, and they can not be replaced. The most you can do is cover it with as many blankets as you can (firewalls, extensive logging, behavior analytics, etc). The biggest question is not whether or not these facilities are compromised, it's whether or not a bad actor is going to use it for malicious purpose. It's one thing to shut down a website for the lols, it's another thing to overload a nuclear reactor and contaminate an entire chunk of the US.

Notice how the article is based entirely on "what ifs". >> "They got to the point where they could have thrown switches" >> "where they could have caused blackouts"

At this point it is a waiting game. Who is going to be the fellow to push the enter key on their keyboard that then causes a 7 digit number of people to go without power, clean water, or even be exposed to radiation? It's understandable that countries feud and people just don't like each other, but actually shutting down key infrastructure like these scenarios suggest is an end game move that establishes the point of no return in global conflict.