Iran-linked hackers shut UK power plant for 4 days in first-of-kind attack

For cybersecurity teams, the four-day outage is a stark validation of long-held fears: a state-linked actor successfully pivoted from intrusion to physical operational disruption. The unnamed UK power plant was not a national grid keystone, but its loss demonstrates that Iranian operators now have the access, and the will, to manipulate power generation environments without triggering a wider blackout.

A report published by The Telegraph on August 23 says hackers with links to Iran shut down an unnamed British power plant for four days in an operation described as the first successful Iranian cyberattack to take a UK electricity-generating facility offline. The incident, disclosed amid a parallel wave of suspected cyberattacks on US water infrastructure across 12 states, has prompted British officials to brief energy company executives and issue cybersecurity guidance to businesses. British authorities have declined to identify the plant, citing security concerns, and the government has played down the broader grid impact because the facility was relatively small. Still, the apparent success has alarmed officials because it suggests threat actors affiliated with Tehran may be capable of penetrating and disabling sensitive energy infrastructure.

“

The report, attributed to The Telegraph and relayed by Ynetnews and the New Zealand Herald, has not been independently confirmed by the National Cyber Security Centre or GCHQ.

The report, attributed to The Telegraph and relayed by Ynetnews and the New Zealand Herald, has not been independently confirmed by the National Cyber Security Centre or GCHQ. The NCSC, the public-facing arm of GCHQ, received the incident report and is responsible for helping organizations defend critical infrastructure against cyber threats. According to the Telegraph, staff spent four days working to restore the facility after the breach. The plant was small enough that losing it for several days had no meaningful effect on national generating capacity. Britain has dozens of smaller power stations connected to the grid, including gas-fired facilities that may operate only intermittently when additional electricity is needed. The targeted facility therefore represents a strategically significant proof-of-concept rather than a catastrophic outage.

The timing is especially relevant. The Telegraph reported that the UK plant incident occurred around the same time as attacks on US water infrastructure last month, which affected facilities in 12 states and caused concern at the White House. That correlation suggests a coordinated or opportunistic campaign targeting Western critical infrastructure, with Iran-linked groups testing the resilience of operational technology environments across multiple sectors. While British and American intelligence agencies have repeatedly warned of the risk posed by hackers from Russia, China, Iran and North Korea, prior major incidents in the UK had mainly brought down National Health Service systems, schools, and commercial manufacturing facilities, including production lines at Jaguar Land Rover. Foreign hacking groups have also stolen customer information from retailers and voter records from the Electoral Commission. But no previous hacking operation is believed to have successfully brought a UK power plant to a standstill.

For cybersecurity professionals, the incident marks a significant escalation from espionage and data theft to physical operational disruption. The ability to force a power-generating asset offline for four days implies that attackers either gained access to control systems, manipulated safety or operational processes, or deployed destructive malware that forced manual shutdown and recovery. That is a far more serious capability than website defacement or data exfiltration. It also raises questions about segmentation between information technology and operational technology networks, remote access controls, and incident response speed. The fact that restoration took four days suggests either contamination of critical systems or deliberate cautious recovery procedures after discovering malicious activity.