Iranian hackers linked to UK energy plant shutdown

A cyberattack on a UK energy facility that forced a four-day shutdown last month was carried out by hackers linked to the Iranian regime. Officials believe this incident marks the first successful infiltration of a British energy site by Iranian-affiliated actors. The Department for Energy Security and Net Zero described the target as a small-scale energy generator, emphasising that there was no risk to the wider energy system or national generation capacity. The specific site has not been named due to national security concerns, and it is understood that the facility does not constitute critical infrastructure.

In response to the breach, the government issued guidance to businesses and instructed power company chief executives on appropriate security measures. Reports indicate the attack coincided with a series of cyber incidents affecting water infrastructure in twelve US states. The National Cyber Security Centre, which operates under GCHQ, had previously raised alarms regarding threats from Iranian-linked hackers following the conflict in the Middle East. The centre warned that UK organisations should prepare for potential collateral impacts from Iran-linked hacktivists, noting that Iranian state actors maintain the capability to conduct cyber operations.

Richard Horne, chief executive of the National Cyber Security Centre, stated in June that the agency had successfully managed more than 200 cyberattacks targeting UK critical infrastructure in the year leading up to May. He noted that three-quarters of these incidents were linked to hostile states. Earlier in the year, Horne identified Iran, China, and Russia as the primary state actors responsible for the most significant cyber threats facing the United Kingdom.