A cyber attack shut down a small British power plant for four days in July. Hackers affiliated with the Iranian regime were responsible, according to the Telegraph. Tony Diver, Rozina Sabur and Matt Oliver broke the story on Saturday. It is thought to be the first time hackers linked to Tehran have closed such a facility in the UK, they wrote.
They described it as the most successful attack of its kind. What the government has confirmed A British government spokesperson confirmed the incident to The Register on Monday. “This story refers to an incident impacting a small-scale energy generator, and at no point was there a risk to the wider energy system,” the spokesperson said.
“The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.” Michael Shanks, the UK energy minister, posted about the attack on X. His department briefed energy chief executives afterwards, he said, and shared advice on the steps companies should take.
The UK has not blamed anyone The government has not formally attributed the attack. That applies to Iran and to any other government or hacking group, The Register reported. Officials declined to identify the power station, citing security concerns.
The National Cyber Security Centre declined to comment. The NCSC sits under GCHQ and handles attacks on critical infrastructure. It does not routinely acknowledge individual incidents. The plant was small This was not an attack on an essential service such as a large power station, Tom Symonds reported for the BBC.
The UK network includes a number of smaller gas generators. They provide short-term power when needed. The Financial Times described the site as a peaker plant. Britain has dozens of them, according to the Telegraph. Many are gas-fired and run for only a few hours a week, for example when wind speeds are low.
A government source told the Telegraph the site sits well below the level at which operators must legally report cyber activity. “It’s a very small-scale site, less than a rounding error compared to grid capacity,” the source said. American water systems were hit at the same time The outage coincided with a series of attacks on US water infrastructure, the Telegraph reported.
Those attacks reached 12 states and caused concern in the White House. Dozens of wastewater treatment plants were affected. The intrusions caused flooding and a loss of pressure from taps. Some authorities told customers to boil water before drinking it.
The first reports emerged in Minnesota on 26 July. Michigan, Georgia, South Dakota and New Jersey followed. The Register put the Minnesota figure at more than 30 facilities, with similar intrusions later reported in at least 11 other states. CNBC reported that the FBI warned about attacks in at least seven states.
CISA, the FBI and the Environmental Protection Agency blamed Iran, CNBC said. How the American attacks worked Most or all of the US utility attacks involved internet-connected programmable logic controllers, The Register reported. Those are the small computers that operate physical equipment such as pumps and valves.
Five federal agencies issued a warning last week. Attackers are now using AI-generated exploitation scripts to break into internet-exposed Siemens S7 controllers, they said, at water, manufacturing and energy sites. “This is not a theoretical risk, it is an active threat,” the agencies said.
“This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs,” Cynthia Kaiser told The Register. Kaiser is a former FBI cyber analyst, now at the Halcyon Ransomware Research Center. What Britain had been told to expect The intelligence and security committee oversees Britain’s spy agencies.
It reported last year that an Iranian cyber attack on British infrastructure was “unlikely”, according to the Telegraph. The same committee called cyber warfare a “significant area of asymmetric strength” for Iran. Tehran spends tens of millions of dollars on hacking groups, it said, each containing hundreds of people.
A Cabinet Office risk assessment published last month put the chance of a serious and successful attack on domestic infrastructure at 5% to 25%. It also warned that “AI can automate the process of launching cyber attacks, making them faster, more efficient and lower the barrier for entry”.
How often this happens Richard Horne runs the NCSC. He said in June that the agency had dealt with more than 200 attacks on critical national infrastructure in the previous year. Horne has also warned that the NCSC now handles at least four nationally significant attacks a week, Cyber Security News reported.
That number could rise sharply if Britain becomes more entangled in the Iran conflict, he said. The NCSC told British organisations in March to review their security in light of the Middle East conflict. The wider campaign Iran has stepped up attacks on Western countries since the US and Israel began air strikes in February, according to the Telegraph.
Germany, Poland, Finland, Belgium and Albania have all reported suspected Iranian attacks. The US Department of Justice charged 17 Iranians on 18 August, CNBC reported. The department called it a massive cyber theft campaign on behalf of the Islamic Revolutionary Guard Corps.
Israel’s national cyber chief said in June that Iranian attacks on the country had tripled in a year. What hackers have done in Britain before Foreign attacks have brought down NHS systems, schools and manufacturing lines, the Telegraph reported. Jaguar Land Rover was among them.
Hackers have also taken retail customer data and voter records from the Electoral Commission. Russian hackers were behind the Jaguar Land Rover attack, which cost the British economy $2.5bn. No hacker had brought a British power plant to a standstill before, according to the Telegraph.
AI and the attack toolkit The federal warning about AI-written exploit code follows other cases this year. Hackers mass-exploited two WordPress flaws in July after AI found the way in. Greg Brockman said this month that OpenAI had underestimated its own models on cyber capability.
Defence has become its own market. SoftBank and OpenAI launched a patching service for Japanese critical infrastructure in June. What is still unknown Neither the government nor the NCSC has said which plant was affected. Neither has said how the attackers got in.
Nobody has said whether the intrusion connects to the American water incidents. No formal attribution has been made. The Department for Energy Security and Net Zero says it is updating its cyber security regulations. A new energy resilience strategy is due later this year, the BBC reported.
Get the TNW newsletter Get the most important tech news in your inbox each week.