A cyber attack on a pump or valve doesn’t end in software - it ends in pressure transients that can rupture pipelines. This paper traces the path from compromised command to hydraulic damage.