Power injection attacks that alter generation and loads at buses in power networks are studied. The system operator employs Phasor Measurement Units (PMUs) to detect such physical attacks, while attackers devise attacks that are unobservable by such PMU networks. Unalterable buses, whose power injections cannot be changed, are also considered in our model. It is shown that, given the PMU locations, the minimum sparsity of unobservable attacks has a simple form with probability one, namely, equation, where equation is defined as the vulnerable vertex connectivity of an augmented graph. The constructive proof allows one to find the entire set of the sparsest unobservable attacks in polynomial time.