Hackers believed to be linked to Iran took a small British power generator offline for four days in July, in what is believed to be the first successful cyberattack to shut down a UK power plant, The Telegraph reported.
The plant hasn’t been identified, and neither British officials nor the National Cyber Security Centre has published a technical account of the attack. It’s not known how the hackers gained access, which systems they reached or why operations stopped.
The outage didn’t affect the wider UK power supply. A government source told The Telegraph that the facility was too small to fall under mandatory cyber-reporting rules for “important generators,” describing its capacity as “less than a rounding error” for the grid.
The disclosure comes as cybersecurity agencies warn of increased targeting of operational technology (OT), including attacks that have caused real-world disruption. On Aug. 27, the NCSC reported increased targeting of OT across several sectors, including in the UK.
Critical Infrastructure Attacks Are Already Causing Physical Disruption
The British generator wasn’t the only physical operation disrupted around that time.
Beginning July 27, water and wastewater utilities in at least seven U.S. states reported cyber incidents to the FBI. Attackers accessed internet-facing Rockwell Automation MicroLogix 1100 and 1400 PLCs and changed their IP addresses and passwords, leaving operators unable to monitor or control the affected devices. The FBI and Environmental Protection Agency said the attacks caused flooding and loss of water pressure, while CISA reported that some utilities issued boil-water notices or had to sustain operations manually.
The FBI described those responsible only as “malicious cyber actors.” It hasn’t publicly attributed the U.S. campaign to Iran, and there’s no public evidence connecting the U.S. campaign to the British incident.
What the incidents do share is operational impact. Both cyber intrusions were followed by disruption to physical operations without bringing down a national power grid.
“A savvy attacker isn't choosing targets based on grid capacity,” said Denis Calderone, CTO of Suzu Labs. “They're probing for the weakest point in the armor, and a facility small enough to fall below mandatory cyber reporting thresholds is exactly the kind of target that's likely under-defended and overlooked.”
Siemens PLC Warning Highlights the Broader OT Risk
On Aug. 19, the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency warned of active targeting of Siemens S7-series PLCs. According to the advisory, attackers were locating exposed Siemens controllers and probing them with AI-generated Python tools designed to resemble legitimate OT monitoring software. The scripts could read and write PLC memory, configuration data, and ladder logic.
The agencies characterized the activity as reconnaissance and capability development. Attackers appeared to be studying specific installations and testing ways to gain access, potentially laying the groundwork for later disruption.
The advisory shows how AI can speed up the process of turning publicly available vulnerability information and open-source software into usable attack tools, potentially reducing the time or expertise required for some stages of targeting industrial controllers. The underlying weaknesses remain familiar: internet exposure, weak network segmentation, and known vulnerabilities left unpatched.
Why Operational Technology Remains Difficult to Defend
Operational technology is difficult to secure partly because many systems were designed for a different threat environment. Controllers and related equipment may remain in service for decades because operators prioritize reliable, safe operation.
Patching or replacing OT equipment can also be more complicated than updating conventional IT. Applying an update can mean taking equipment or an entire production process offline. Operators may also need to test compatibility and verify that safety systems still work as intended.
Connectivity creates another challenge. Internet-facing controllers, old cellular modems, vendor maintenance accounts, and forgotten remote-access links can all provide routes into an OT network. The NCSC has warned that unintended exposure can result from misconfigurations, legacy connections, and unmanaged assets.
Operators must also balance cybersecurity against operational and safety risks when deploying patches, which can delay remediation even when vulnerabilities are known.
The Cabinet Office’s 2026 National Risk Register put the two-year likelihood of a serious cyberattack on domestic infrastructure at 5% to 25%. It also warned that AI can automate parts of an attack, making them faster and lowering the barrier to entry.
Operators can start by identifying every OT asset reachable from the internet, removing unnecessary exposure, replacing default passwords, reviewing vendor and integrator access, separating OT from business networks and documenting what each site needs to recover.
“Take controllers off the internet. Change default credentials. Inventory every communication path,” Calderone said.
What Small Incidents Reveal About a Bigger OT Exposure
Neither the British generator outage nor the U.S. water incidents threatened a national power grid or a major population center. But both produced operational consequences, showing that attackers do not need to compromise the largest or most critical facilities to disrupt physical processes.
The plant’s size also points to a potential visibility gap. Facilities that fall outside mandatory reporting requirements may not generate the same level of disclosure, leaving regulators and other operators with a less complete picture of cyber incidents affecting smaller infrastructure providers.
The UK and U.S. incidents do not share any publicly identified hardware, vulnerability or attack path. Their common thread is narrower but still significant: attackers gained access to systems tied to physical operations and caused disruption.
In the UK case, however, defenders still do not know what made that possible. It remains unclear whether attackers reached an internet-exposed PLC or gained access through a remote connection. It’s also unknown whether they manipulated the physical process or whether plant operators took the generator offline after detecting the intrusion.
A cyberattack that directly stops industrial equipment presents a different defensive lesson from an IT compromise that prompts operators to shut down a facility as a precaution. Without a technical account, other operators cannot determine which controls failed or what might have broken the attack chain.
“The point of incident reporting should not simply be counting attacks,” said Donald McFarlane, an advisory board member at Xcape. “It should be making the next attack harder.”
Operators don’t need to wait for more details before checking their own OT exposure and recovery plans. But a sanitized technical account of the UK attack could help them determine whether they face similar weaknesses rather than having to guess.
