Iran-linked hackers shut down British power plant in unprecedented cyber attack

The incident, revealed by The Telegraph last night, is also considered the most successful cyber attack of its kind against British infrastructure.

Officials refused to reveal which power plant was targeted over security concerns.

Staff at the facility spent four days working to restore operations and bring systems back online.

The attack came at the same time as a wave of cyber strikes against US water infrastructure last month, which hit 12 states and raised alarm at the White House.

Ministers insisted the affected plant in Britain was relatively small, and the outage had no impact on the UK’s wider power supply or energy generation.

Dozens of small-scale power plants are connected to the national grid across Britain, many of which are gas-fired and operational for only a few hours each week.

A four-day shutdown at such a facility would not affect the broader grid.

The attack is unlikely to have been intended to cause real harm to civilians and is not thought to have been widely noticed by the public.

It may, however, have been designed to demonstrate that hackers tied to Iran’s Islamic Revolutionary Guard Corps (IRGC) could penetrate UK systems and disable sensitive infrastructure.

The Government responded by briefing power company chief executives and writing to businesses with guidance.

The incident was reported to the National Cyber Security Centre, the public-facing arm of GCHQ.

Back over in the US, those attacks struck dozens of wastewater treatment plants, leading to flooding, reduced water pressure, and boil-water advisories for some communities.

Minnesota reported its first incident on July 26, with similar breaches following in Michigan, Georgia, South Dakota and New Jersey.

The FBI attributed the incidents to "malicious cyber actors", with US Government sources later confirming to media that the threat likely originated in Tehran.

Iran has sharply escalated its cyber operations against Western nations amid the Middle East conflict since 2023, and in particular since the start of "Operation Epic Fury" earlier this year.

Suspected Iranian cyber attacks have also been reported in Germany, Poland, Finland, Belgium and Albania, though Israel and other Middle Eastern states remain the primary targets.

Experts have long cautioned that the UK is ill-equipped to handle the scale of hostile cyber operations from foreign states.

The intelligence and security committee, which oversees Britain’s spy agencies, assessed last year that an Iranian cyber attack on UK infrastructure was "unlikely".

But the same committee warned that cyber warfare was a "significant area of asymmetric strength" for Iran, which invests tens of millions of dollars in hacking units staffed by hundreds of operatives.

In June, NCSC chief executive Richard Horne said the agency had dealt with more than 200 attacks on critical national infrastructure over the preceding year.

A Cabinet Office risk assessment published last month put the likelihood of a serious cyber attack on domestic infrastructure at between five and 25 per cent, warning that "AI can automate the process of launching cyber-attacks, making them faster, more efficient and lower the barrier for entry."

A Government source counselled calm, said: "We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near.

"It’s a very small scale site, less than a rounding error compared to grid capacity."

A Government spokesman said: "The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.

"This story refers to an incident impacting a small-scale energy generator, and at no point was there a risk to the wider energy system."