UK Power Generator Cyberattack Linked to Iran

By Alexandra Ryabov

A small British power generator was forced offline for four days in July following a cyberattack reportedly linked to Iran. The incident, which only became public on 22 August, is believed to be the first successful Iran-linked cyberattack to cause this kind of disruption to UK energy infrastructure. The UK Government has confirmed that a cyber incident affected a small-scale energy generator but has not publicly attributed responsibility.

Energy Minister Michael Shanks said there was no threat to the wider grid and that nobody lost power, stressing that the affected generator was “tiny” compared with what most people would consider a power station. Following the incident, the Government briefed energy executives and issued further security advice, whilst continuing to work with regulators and the National Cyber Security Centre (NCSC) to assess threats and strengthen protections.

The incident comes amid wider concern over Iranian cyber activity targeting critical infrastructure. On 26 and 27 July, more than thirty community water systems in Minnesota were targeted in a coordinated cyberattack. Although the attacks have not been formally attributed, their timing and methods reportedly shared characteristics with previous activity involving critical infrastructure, whilst Iranian-linked hackers have previously targeted internet-connected industrial control systems used by US water facilities.

The UK incident is significant because the attackers caused a physical process to remain offline for four days. This comes against an already elevated cyber threat to British infrastructure. In June, NCSC chief executive Richard Horne revealed that the agency had managed more than 200 incidents affecting UK critical national infrastructure and its supporting ecosystem in the year to May, around 75 per cent of which were believed to be linked to state actors. He warned that Russia, China, and Iran are increasingly targeting systems underpinning essential UK services.

The incident also exposes the vulnerability of small energy infrastructure in the UK. The Government has acknowledged that the existing Network and Information Systems regulations do not provide comprehensive coverage of the energy system, leaving some operators outside the main cyber security regulatory framework. Its May 2026 Energy Sector Cyber Security Strategy commits to extending baseline cyber resilience across the wider energy system, demonstrating a step forward to their protection.

As cyber attacks and other forms of foreign sabotage against critical infrastructure increase, smaller assets with fewer protections or weaker cyber resilience could present more accessible targets for hostile actors seeking opportunities to cause disruption. The Government’s intended regulatory developments should provide a stronger foundation for protecting smaller energy infrastructure. However, smaller operators will need to assess their individual risks and strengthen their protections accordingly, supported by continued guidance, oversight and collaboration with Government, regulators and the NCSC.