A cyberattack reportedly linked to Iran forced a small UK power generator offline for four days. Cybersecurity experts from Barrier Networks, Illumio, Advania UK, OPSWAT, Orange Cyberdefense and e2e-assure discuss what the incident reveals about the growing threat to critical national infrastructure and the challenges of securing increasingly connected Operational Technology environments.
A small UK power generator was forced offline for four days in July following a cyberattack reportedly linked to Iran. Although the incident posed no threat to the wider energy system, it has raised concerns about the vulnerability of critical national infrastructure.
The NCSC and other authorities are assessing the threat, while the Government has briefed energy companies on strengthening cybersecurity. The attack is particularly significant because it caused operational disruption, reinforcing previous warnings about hostile-state cyber threats to essential infrastructure.
A warning for critical infrastructure
For Euan Carswell, SOC Team Lead at Barrier Networks, the incident demonstrates why previous warnings about state-backed attacks on critical infrastructure need to be taken seriously.
“This attack represents a real escalation and validates many of the prior warnings about the potential risk of state-backed hackers to critical national infrastructure (CNI).
“For security reasons, the specifics of this attack are unclear, but hackers allegedly targeted and knocked out a smaller power plant for four days, likely a gas plant supplying on-demand energy to account for spikes in usage.
“Even if knocking out a smaller plant like this did not translate to serious real-world disruption, it shows that an attack on a large plant is viable. Even more importantly, it shows the amount of time it can take to recover, and the damage that could result from an outage of even a few days.”
Carswell warned that disruption at a larger provider could potentially affect organisations ranging from hospitals and schools to police stations and government buildings.
Ric Derbyshire, Principal Security Researcher at Orange Cyberdefense, believes the significance of the incident also extends beyond the amount of generating capacity affected.
“A four-day outage at a UK generation site is still significant even when the lost capacity, as in this case, is small. The incident creates a second-order cognitive effect across wider society by showing that UK energy infrastructure can be reached and disrupted through cyberactivity. That perception can shape how people view the resilience of critical infrastructure and potentially undermine public trust and confidence.”
However, Rob Demain, CEO of e2e-assure, cautions against drawing conclusions that go beyond what is currently known about the incident.
“At this time, we don’t know much about the attack beyond that the power plant experienced downtime, which could have been a direct effect of the attack, part of the defensive response, or a combination of both. What it does demonstrate is that state-linked actors have both the intent and capability to target relatively ordinary industrial technology and are establishing access within the technology underpinning CNI that could potentially be used to cause disruption in future conflicts.
“The conclusion, however, should not be that Iranian hackers have demonstrated an ability to switch off Britain’s whole electrical grid, but it does highlight the challenges the industry is facing. The electricity system is becoming increasingly distributed and, while one asset is of little consequence, a weakness that is repeated across hundreds of similar assets could compound to a significant problem due to the technology and suppliers the grid relies on.”
The convergence of IT and Operational Technology
One of those challenges is the increasing connectivity between conventional IT systems and Operational Technology (OT).
Trevor Dearing, Senior Director of Critical Infrastructure at Illumio, believes ageing infrastructure combined with greater connectivity is expanding the potential attack surface.
“The biggest concern is that a power plant can suffer four days of downtime despite repeated warnings about the threat from nation-state and politically motivated groups. The saving grace is that the attacker hit a small plant rather than one capable of disrupting the wider UK energy system.
“Cyberattacks are increasingly part of geopolitical conflict, and the energy sector is particularly vulnerable. Ageing infrastructure combined with increasingly connected IT, operational technology and smarter grids creates more entry points for attackers and greater potential for disruption.”
James Neilson, SVP of Global at OPSWAT, similarly believes energy organisations need to understand the relationship between threats originating in IT environments and their potential impact on industrial systems.
“Power plant security teams need to understand how IT threats can impact their OT environments. Organisations must detect and neutralise hidden threats by managing data flows and inspecting files in transit across devices, users and the broader digital supply chain.”
Legacy infrastructure creates a difficult balancing act
Protecting Operational Technology can be particularly challenging because industrial environments frequently depend on legacy systems that cannot be updated as easily as conventional enterprise IT.
Demain said the route used by the attackers remains unclear and cautioned that compromising critical infrastructure does not necessarily require highly sophisticated techniques.
“How they got into the powerplant isn’t currently clear, but it doesn’t necessarily have to have been a sophisticated attack. CNI is vulnerable to all sorts of basic security challenges: exposed Internet-facing devices, compromised remote access credentials, vulnerable gateways, or compromised third-party accounts.”
Operators also face a difficult balance between addressing vulnerabilities quickly and avoiding interventions that could disrupt industrial processes or create safety issues.
“The challenge with securing operational technology (OT) is that it runs on legacy software that can’t be easily patched remotely, and operators always have to weigh up the operational and safety consequences of intervening as an outage or downtime could threaten safety. Replacing legacy systems takes time and has to be done with a lot of thought and care, but operators can’t accept exposure in the meantime. They must balance moving carefully when changing the plant, but quickly when reducing the risk around it.”
Demain said immediate measures can include identifying Internet-facing systems, removing unnecessary remote-access routes, disabling dormant supplier accounts, rotating weak or compromised credentials and restricting who can reach operational systems.
Cybersecurity becomes part of geopolitical conflict
The incident also needs to be viewed against a broader backdrop in which cyberattacks are increasingly being used alongside more traditional forms of geopolitical confrontation.
Pravesh Kara, Director of Cyber Resilience Services at Advania UK, believes critical infrastructure is increasingly caught in the middle.
“Iran’s state-backed cyber teams are among the most capable and persistent in the world, and as recent conflicts show, they’re using cyber operations as a primary weapon, favouring disruption and strategic messaging over traditional military strikes.
“Cyberwarfare is rapidly overtaking kinetic warfare as the main threat to national security. Critical infrastructure in the UK and elsewhere is increasingly in the crossfire, just as Iran’s own systems have been targeted. With Iranian and allied hacktivist groups ramping up attacks, the threat of a major, public-impacting cyber event has never been so great.”
Derbyshire also places the incident within a broader pattern of hostile-state activity against national infrastructure.
“The incident also sits within a wider increase in hostile-state and state-aligned activity against national infrastructure. The NCSC has warned repeatedly about this trend and about the growing use of cyber operations as part of wider geopolitical pressure.”
While neither the actors responsible nor the specific technology affected have been confirmed, Derbyshire believes defenders need to consider the possibility of threat actors increasingly seeking visible disruption of physical infrastructure.
“While the actors and specific technology affected in this incident are not confirmed, the shape of the event seems to follow a broader pattern of actors chasing the metaphorical cyber-dragon for bigger and more shocking impacts, including disruption of OT within CNI. If this escalation continues, defenders should expect more actors to pursue overt disruption of physical infrastructure.”
Dearing argues that cybersecurity therefore needs to be built into essential infrastructure rather than treated primarily as a compliance requirement.
“Operators of essential services must build cybersecurity into their infrastructure. Compliance must be much more specific on visibility, secure connectivity, and the use of secure industrial protocols. Every operator needs to be able to keep systems running, recover quickly and maintain essential services under constant attack.”
Looking beyond a single generator
Perhaps the most important question raised by the incident is not what happened to one relatively small power generator but whether the same weaknesses could exist elsewhere.
The UK’s electricity system is increasingly distributed, meaning vulnerabilities repeated across multiple assets could present a much more significant risk than a compromise affecting a single facility.
Demain believes this should be a priority for infrastructure operators as they assess the lessons from the attack.
“The question I would take from this incident is not how we protect one small generator but whether the same route into that generator exists across fifty others, and while we work carefully on the permanent fix, are we moving fast enough to stop somebody using it first?”
The four-day outage may not have threatened the wider UK electricity system, but it provides a reminder that critical infrastructure security is ultimately about more than preventing an initial intrusion. Visibility across IT and OT, tighter control of remote access, protection of legacy infrastructure and the ability to recover quickly will all be crucial as cyberthreats become an increasingly prominent element of geopolitical conflict.
