London — Hackers affiliated with the Iranian government reportedly shut down a small UK power plant for four days in July, marking what is believed to be the first known cyberattack to successfully take a British energy facility offline.
The incident, first reported by The Telegraph, affected a relatively small generator. UK officials have not identified the facility for security reasons. Staff worked for four days to restore its systems and bring it back online. The shutdown had no impact on the wider UK electricity network or national energy generation. A government source said its generating capacity was “less than a rounding error compared to grid capacity.”
The Department for Energy Security and Net Zero (DESNZ) confirmed that the incident involved a small-scale energy generator and said there was no risk to the wider energy system. The government described the UK energy system as highly resilient and said it was working closely with the energy sector to protect critical infrastructure.
The incident was reported to the National Cyber Security Centre (NCSC), part of GCHQ. The government subsequently briefed chief executives of major power companies and issued cybersecurity guidance to businesses. Officials said the affected generator was below the threshold requiring larger generators to formally report cyber incidents.
Possible Iranian Cyber Operation
Officials believe the attack may have been intended as a proof of concept, demonstrating that Iran-linked hackers, including actors associated with the Islamic Revolutionary Guard Corps (IRGC), have the capability to penetrate and disrupt sensitive Western infrastructure.
The UK attack occurred around the same time as a series of cyberattacks against water infrastructure across 12 US states, including Minnesota, Michigan, Georgia, South Dakota and New Jersey. Some attacks caused operational problems such as localized flooding, reduced water pressure and boil-water advisories.
US authorities initially described those responsible as “malicious cyber actors,” while later government sources linked the campaign to Iran. US agencies have not publicly attributed every incident to Iran.
UK Warns of Growing Infrastructure Threat
The incident follows previous warnings from UK and US intelligence agencies about cyber threats from state actors, including Russia, China, Iran and North Korea, against critical infrastructure.
NCSC Chief Executive Dr Richard Horne said hostile states accounted for around three-quarters of more than 200 cyber incidents affecting UK critical national infrastructure and related systems in the year to May 2026. He also said the NCSC handles about four nationally significant incidents each week, with most linked to state actors.
A UK Cabinet Office risk assessment published a month before the power-plant incident estimated the likelihood of cyberattacks against domestic infrastructure at between 5% and 25%. It also warned that artificial intelligence could help automate attacks and make them faster to conduct.
In March, NCSC Director for National Resilience Jonathan Ellison warned UK organisations to remain alert to cyber risks linked to rapidly changing geopolitical events in the Middle East.
The incident also follows a wider pattern of cyber threats against European infrastructure. In September 2025, UK authorities arrested a suspect in connection with a major cyberattack that disrupted passenger check-in and boarding systems at London Heathrow and several other European airports.
The UK government is updating cybersecurity regulations for the energy sector and developing a new energy resilience strategy expected later this year. No further operational details about the affected plant or the specific methods used in the attack have been publicly released.
——— End of Article ———
