Iranian hackers shut down UK power plant for days

Iran-linked hackers shut down British power plant for four days in major cyberattack.

By World Israel News Staff

Hackers linked to Iran forced a British power facility offline for four days in what is believed to be the first successful cyberattack of its kind against a UK electricity generator, according to British media reports.

The attack occurred in July and targeted a relatively small energy generator, The Telegraph first reported Saturday. British authorities have declined to identify the facility, citing security concerns.

Officials said the shutdown did not disrupt Britain’s broader electricity supply, but the incident has raised concerns over the ability of Iran-linked cyber groups to interfere directly with Western critical infrastructure.

“This story refers to an incident impacting a small-scale energy generator, and at no point was there a risk to the wider energy system,” a spokesperson for Britain’s Department for Energy Security and Net Zero said.

“The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards,” the spokesperson added.

The facility remained out of operation for four days while personnel worked to restore it.

A British government source sought to emphasize the relatively small scale of the installation.

“We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near,” the source told The Telegraph. “It’s a very small-scale site, less than a rounding error compared to grid capacity.”

Despite its limited impact on Britain’s overall power supply, the attack constitutes a major escalation, as Iran-affiliated hackers succeeded in taking an electricity-generating facility offline rather than merely stealing information, defacing websites or temporarily disrupting internet services.

The British government subsequently briefed executives from energy companies and sent businesses security guidance and instructions following the incident.

The National Cyber Security Centre, the cybersecurity arm of Britain’s GCHQ intelligence agency, was also informed of the attack, according to reports.

The incident followed repeated warnings from British authorities about the danger posed by state-backed or state-aligned hackers.

Earlier this year, NCSC chief executive Richard Horne said the agency was dealing with an average of four nationally significant cyber incidents each week and that most were now originating directly or indirectly from nation states.

“We know that Iran is almost certainly using cyber activity to support the repression of British individuals on our streets who are seen as a threat to the regime,” Horne said in April.

The NCSC also warned organizations following the escalation of fighting in the Middle East that Iranian state and Iran-linked hackers retained the ability to carry out cyber operations and that companies should strengthen their defenses.

The British power plant attack reportedly occurred around the same time as a major series of cyberattacks against water utilities in the United States.

More than 30 municipal water systems in Minnesota were targeted on July 26 and 27, with similar attacks reported in other states. Some utilities were forced to switch to manual controls after attackers interfered with internet-connected equipment governing pumps and other water-system operations.

Federal investigators did not publicly make a definitive attribution at the time, although US cybersecurity agencies had warned shortly before the attacks that Iran-linked hackers were targeting programmable logic controllers and other equipment used by water utilities and critical infrastructure operators.

President Donald Trump publicly rejected suggestions that Iran was responsible for the Minnesota incidents.

“I don’t think there was an Iranian cyberattack,” Trump said during a July 31 Cabinet meeting at Camp David. “I think that Minnesota ought to get its act together.”

The FBI continued investigating the attacks, while cybersecurity specialists noted similarities to tactics previously employed by Iran-linked hacking groups.

One of the best-known groups is CyberAv3ngers, which US authorities have linked to Iran’s Islamic Revolutionary Guard Corps.

In a previous campaign beginning in 2023, IRGC-affiliated hackers compromised industrial control equipment in US water and wastewater facilities, as well as organizations in the energy, manufacturing and healthcare sectors.

US agencies said those attacks frequently exploited relatively simple vulnerabilities, including industrial controllers exposed directly to the internet and devices that continued to use factory-default passwords.

The latest British incident suggests that even attacks against comparatively small facilities can have substantial operational effects.

British officials have stressed that there was never a threat of widespread blackouts, and the targeted generator was not considered significant to the national electricity system.

However, the ability of suspected Iran-linked hackers to keep an operating power facility offline for four days marks a potentially significant development as Western governments increasingly warn that cyberattacks are becoming an integral part of conflicts between states.

The NCSC has warned that cyber operations are now “as much a reality of modern warfare as drones and missiles,” with hostile governments and affiliated groups increasingly targeting the systems that provide electricity, water and other essential services.