Suspected Iran-Linked Cyberattack Shut Down a Small UK Power Plant

A suspected Iran-linked cyberattack shut down a small UK power plant this summer, and the British government has now confirmed the incident. A government spokesperson told The Register on Monday that the attack affected a “small-scale energy generator.”

“At no point was there a risk to the wider energy system,” the spokesperson said, adding that the UK’s energy system is “highly resilient” and that the government works “closely with the energy sector to protect infrastructure.” UK Energy Minister Michael Shanks said on X that his department briefed energy company CEOs after the incident and “shared further advice with companies on the steps they should take to stay secure.”

Officials have not said which power station was hit, and the UK has not formally attributed the attack to Iran or any other government or group. The Telegraph, which first reported the incident, said the plant was shut down for four days in what is believed to be the first disruptive Iranian cyberattack of its kind in the UK.

Part of a Wider Campaign Against OT

The incident happened around the same time as a wave of intrusions at U.S. water utilities. In late July, suspected Iranian operatives disrupted more than 30 water facilities in Minnesota, and similar intrusions were later reported in at least 11 other states, according to The Register. Officials have not attributed those attacks either, though private-sector threat analysts told the publication that Iran is “almost certainly” responsible. Most or all of the U.S. utility attacks involved internet-connected programmable logic controllers.

Federal agencies have since warned that attackers are using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series PLCs at water, manufacturing, energy and other critical facilities. “This is not a theoretical risk – it is an active threat,” the FBI and four other federal agencies said.

“This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs,” Cynthia Kaiser, SVP of the Halcyon Ransomware Research Center and a former FBI cyber analyst, told The Register. “Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society.”

What Operators Should Take From It

The common thread in these incidents is industrial equipment reachable from the internet. Operators of smaller generators and utilities, which often have thinner security teams than large grid operators, should inventory any PLCs and remote-access paths that face the internet, remove direct exposure where possible and apply the vendor and government guidance that UK officials have shared with the energy sector. The plant’s four-day outage shows that a small site can still be knocked offline for days when its control systems are exposed.