Iran-linked hackers temporarily shut down UK power plant, officials say

Iran-affiliated hackers succeeded in taking a United Kingdom power plant offline for four days in July, according to reports from British newspapers. The incident, described as the first successful shutdown of a UK energy facility by Iranian-linked actors, did not affect the national power supply and involved a small-scale plant whose identity has not been disclosed.

The breach coincided with a series of attacks on water infrastructure in about a dozen U.S. states, where operators were locked out, leading to pressure loss and flooding. In both cases, the attackers targeted programmable logic controllers (PLCs), the computer systems that manage industrial processes across sectors such as energy, water, manufacturing and transportation.

"Iranian-linked actors are using simple techniques that include scanning for exposed devices and exploiting default credentials," a U.S. Cybersecurity and Infrastructure Security Agency (CISA) official said.

CISA noted that many PLCs were designed before modern cybersecurity standards and remain vulnerable, with thousands still exposed on the public internet. The agency also said responsibility for securing these devices often falls to individual plant operators, many of which lack dedicated cybersecurity staff.

British officials declined to confirm the incident, and the National Cyber Security Centre neither confirmed nor denied the hack. Security experts suggested the attack may have been a proof-of-concept effort to test methods before targeting larger, higher-value assets.

The United Kingdom has previously warned of Iranian-linked cyber activity, intensifying its alerts earlier this year amid heightened geopolitical tensions.