Iran-Linked Hackers Take UK Power Plant Offline in Unprecedented Cyberattack
Hackers suspected of being linked to Iran successfully took a small UK power plant offline for four days, marking a significant escalation in attacks against critical infrastructure.
A cyberattack attributed to hackers linked to Iran forced a British power plant offline for four consecutive days last month, marking what officials describe as the first successful attack of its kind against UK energy infrastructure. The incident, first reported by The Telegraph, has raised fresh alarm over the vulnerability of critical infrastructure amid heightened tensions between the UK, US, and Tehran.
According to the UK government, the affected facility was a small-scale energy generator, and officials have stressed that at no point was there any risk to the broader national grid. A spokesperson for the Department for Energy Security and Net Zero (DESNZ) said the incident "impacted a small-scale energy generator" and reiterated that "the UK has a highly resilient energy system," adding that the government works closely with the energy sector to maintain the highest security standards. A government source went further, telling reporters that the targeted site was "less than a rounding error compared to grid capacity" and fell well below the legal thresholds that require significant generators to report cyber incidents.
Despite the reassurances, security analysts view the attack as a notable escalation. It is believed to be the first time hackers affiliated with the Iranian regime have successfully forced a UK power facility to shut down entirely. This comes shortly after London granted the United States permission to launch defensive military operations against Iran from British bases.
The attackers' likely goal was not to cause widespread harm but to demonstrate that groups linked to Iran's Islamic Revolutionary Guard Corps can penetrate UK infrastructure and disable it at will. This is being called a "successful proof of concept" even though it went largely unnoticed outside the energy industry.
The outage reportedly occurred in July, around the same time that US agencies, including the FBI, CISA, and the EPA, issued warnings about Iran-linked actors targeting water utilities across multiple states, according to The Telegraph report. That parallel timing has fueled speculation that Tehran-affiliated groups are conducting a broader, coordinated campaign against Western critical infrastructure rather than isolated, opportunistic intrusions.
The National Cyber Security Center (NCSC), which is responsible for defending the UK's critical infrastructure and operates under GCHQ, has not publicly confirmed details of the specific incident and did not identify the facility involved, citing security concerns. However, it is understood that no outages were formally reported by regulated operators of major power stations, reinforcing the government's position that the wider electricity supply was never threatened.
Following the incident, DESNZ briefed energy sector chief executives and issued written guidance to companies on strengthening their defenses. Officials have indicated that cybersecurity regulations for the sector are now being updated. GCHQ's NCSC chief executive, Richard Horne, has separately warned that the agency now handles at least four "nationally significant" cyberattacks every week, cautioning that such incidents could increase sharply if the UK becomes more directly entangled in the wider Iran conflict.
This new report from SecurityWeek provides additional context and expert commentary on the UK power plant cyberattack, emphasizing the potential for repeatable attacks and questioning the recovery time. It highlights that while the specific facility was small, the four-day operational disruption is a significant concern for the resilience of distributed energy infrastructure. The article also pushes back against claims of 'little activity' from Iran-linked groups, detailing a broader pattern of attacks against US allies since the conflict with Israel began.
This new report from Infosecurity Magazine provides further expert commentary on the UK power plant cyberattack, emphasizing the broader implications for critical national infrastructure (CNI) resilience. It highlights concerns about potential visibility gaps for smaller CNI operators and the need for robust recovery plans, even when the targeted facility is not large. The article also references a July 2025 warning from UK lawmakers about Iran's cyber threat and notes that the UK power plant breach was considered 'unfortunately inevitable' by some experts due to under-investment in CNI protection and the use of legacy systems.
This new report provides additional context on the UK power plant cyberattack, highlighting that the incident affected a "small-scale energy generator" and did not impact the national power supply. It also details the UK Minister of State's confirmation of the event and subsequent briefings to energy CEOs, along with expert commentary emphasizing the need for continuous assurance and testing of critical infrastructure defenses against state-linked actors.
This new report from The Register provides further details on the UK power plant cyberattack, confirming that the incident disrupted operations for four days. While the UK government has not formally attributed the attack, it is believed to be the first disruptive Iranian cyberattack of its kind in the UK, following similar disruptions at US water facilities. The government emphasized the resilience of the broader energy system and shared security advice with energy companies.
The United States has officially sanctioned four Iranian nationals for their alleged involvement in cyberattacks targeting critical infrastructure, including the recent intrusion at a UK power plant. This move by the U.S. Treasury Department, which links the actors to a broader "economic D-Day" strategy, adds a layer of international pressure and condemnation to the incident. The sanctions highlight a coordinated effort to counter state-sponsored cyber aggression against essential services.
Operational technology security leaders are urging the UK government to disclose more technical details about the cyberattack that disrupted a small power plant for four days last month. Experts like Markus Mueller of Nozomi Networks expressed concern over the government's reticence, contrasting it with the detailed public breakdown provided by Poland's CERT following a similar attack on its energy grid. The lack of transparency hinders the ability of security professionals to learn from the incident and implement preventative measures against future attacks on critical infrastructure.
While the initial reports linked the cyber incident at a UK power plant to Iran-linked hackers, the new article clarifies that official attribution is absent. Technical details such as the specific entry point, exploited vulnerability, or malware used remain unconfirmed by government agencies or the NCSC. The incident's duration of four days is highlighted as a reflection of the complex recovery process for industrial sites, rather than just lost generation.