Iran-Linked Hackers Shut UK Power Plant

24 August 2026

Executive Summary

A cyberattack attributed in reporting to Iran-linked hackers forced a small UK gas-fired power plant offline for approximately four days in July, according to reporting published this weekend.

The affected facility was a roughly 15MW gas-fired “peaker” plant — a type of generator designed to provide additional electricity when demand is high.

The plant has not been publicly identified.

The UK’s National Cyber Security Centre was informed of the incident, and senior executives across the energy sector have subsequently been briefed about the threat. 

Importantly, the facility was small and the incident did not threaten the stability of Britain’s national electricity system.

But that is not the most important risk lesson.

The incident demonstrates something considerably more significant for businesses:

A cyberattack can cause physical operational shutdown inside UK critical infrastructure without causing a conventional IT outage.

UK Impact

Peaker plants are particularly interesting from a cyber-risk perspective because many are:

• Small.
• Highly automated.
• Remotely operated.
• Frequently unmanned.
• Controlled through industrial systems.

The technology controlling physical equipment is known broadly as operational technology — OT.

This can include programmable logic controllers controlling:

• Generators.
• Pumps.
• Valves.
• Turbines.
• Temperature.
• Pressure.
• Industrial machinery.

The cyber perimeter therefore extends far beyond corporate laptops and servers.

A compromised industrial controller can potentially stop the physical asset itself.

Global Impact

The Financial Times reports that the incident has heightened concern across Britain’s energy sector about Iran-linked cyber activity. 

Iran-linked groups have previously been associated with attacks against industrial control equipment internationally, including programmable logic controllers used in water infrastructure.

That matters because relatively unsophisticated infrastructure can become attractive to hostile actors if it is:

• Internet-accessible.
• Poorly segmented.
• Remotely administered.
• Running older equipment.
• Using weak authentication.

Small assets should not assume they are too insignificant to be targeted.

Their very simplicity may make them attractive.

Our View

This incident deserves attention not merely from energy companies but from any organisation operating remotely controlled physical equipment.

Businesses should ask:

• Which industrial controllers are internet-accessible?
• Which systems can be operated remotely?
• Are OT networks separated from corporate IT?
• Are default credentials still present anywhere?
• Is multifactor authentication used for remote access?
• Who monitors industrial equipment outside working hours?
• Are legacy controllers still receiving security updates?
• Can equipment be operated manually if control systems fail?
• Are engineers included in cyber-response exercises?
• Could a cyber incident physically damage equipment?
• How long could the operation remain offline?
• Do suppliers and maintenance contractors have remote access?

There is also an important insurance question.

Companies should establish how their programme responds when a cyberattack causes:

• Physical shutdown.
• Machinery damage.
• Business interruption.
• Increased cost of working.
• Loss of utility supply.

Traditional property policies and cyber policies can contain very different definitions and exclusions.

Businesses therefore need to understand whether there is a gap between the digital event and the physical loss.

The lesson from this incident is not that Britain’s electricity system was nearly brought down. It wasn’t.

The lesson is arguably more useful:

A hostile actor apparently managed to turn a cyber intrusion into four days of physical business interruption at a real UK power-generating asset.

That boundary between cyber risk and physical risk is becoming increasingly difficult to draw.

Risk Indicator: HIGH – CRITICAL & INDUSTRIAL INFRASTRUCTURE

Disclaimer

The information contained within these Market Alerts is provided for general market awareness and informational purposes only. It does not constitute financial, legal, investment, regulatory or insurance advice. Whilst every effort has been made to ensure accuracy at the time of publication using multiple reputable and independently verified sources, geopolitical events, legislation, regulation and market conditions may change rapidly. Readers should obtain appropriate professional advice before acting upon any information contained herein.

Invictus Risk Solutions LLP – Helping organisations stay ahead of emerging risks through informed insight and independent analysis.