Pardon? A month or two without power does not seem like an enormous crisis?

Stuxnet destroyed centrifuges. It does not seem impossible that a sophisticated attack could shred some critical equipment. During the Texas 2021 outage -they were incredibly close to losing the entire grid and being in a blackstart scenario. Estimates were that it could take weeks to bring back power - all this without any physical equipment destroyed or malicious code within the network.

Edit: Had to look it up, the Texas outage was "only" two weeks and scattershot in where it hit. The death toll is estimated at 246-702.

https://en.wikipedia.org/wiki/2021_Texas_power_crisis

> Or am I missing the gravity somehow?

Yes, there is the risk of cascading failures, some industrial processes are very hard to re-start once interrupted (or even impossible) and the lead time on 'some transformers' can be a year or more. These are nothing like the kind that you can buy at the corner hardware store. A couple of hundred tons or so for the really large ones.

Grid infra is quite expensive, hard to replace and has very long lead times.

The very worst you could do is induce oscillations.

Transformers and turbines of any significance are not off the shelf parts and can have lead times of years

I've seen less-than-credible software in an ATM and in a "ring up your own groceries" station. No idea who's behind it or who would care, though.

It's middle of winter, and it gets pretty danged cold. Being without power in such weather might well end up being deadly, even with short durations.

Consider that if a cyberattack could destroy a major power grid transformer, for a marginal cost approaching zero, versus the low-end US$10 million a Kinzal ballistic missile would cost to do the same thing (presuming you only need 1 which is...unlikely), that that might be a significant military capability.