Cyberattack Shut Down a Small British Generator for Four Days. The Telegraph Cited an Iranian Link, but the Government Has Not Confirmed It

The British daily The Telegraph wrote on Sunday that a cyberattack shut down a power-generation facility in the United Kingdom for four days in July and that hackers linked to the Iranian regime were behind it. According to the newspaper, it would be the first successful attack of this kind on British energy infrastructure. The government did not deny the incident, but it did not confirm the report’s two main claims. It did not officially attribute the attack to anyone and refused to name the facility that was hit. CNBC ↗

A government spokesperson said in a statement that the “report concerns an incident that affected a small electricity generator, and at no point was there a risk to the wider energy system”. He added that the country has a “highly resilient energy system”. The size of the facility is more important than the headlines suggest. The British grid has several smaller gas generators that supply electricity for short periods as needed, and this was not an attack on an essential service such as a large power plant. BBC ↗

Another detail softens the impact of the report. According to The Telegraph, the National Cyber Security Centre, which falls under the GCHQ intelligence agency and handles attacks on critical infrastructure, received no reports of outages in connection with the attack. Britain’s Department for Energy Security nevertheless discussed the incident with energy company chiefs and sent companies recommendations for reducing the risk of cyberattacks. The government is also revising cybersecurity rules and preparing a new energy resilience strategy for this year. RTÉ ↗

The case carries weight mainly because of its timing. According to The Telegraph, the attack took place at a time when the FBI, CISA and the U.S. Environmental Protection Agency were warning about attackers who had remotely accessed water utility systems in at least seven U.S. states. The list later expanded to twelve states. In Minnesota, it involved more than thirty water systems. The attackers changed IP addresses and passwords and gained reach into pumps, valves and pipeline pressure, meaning water utilities lost oversight of their own operations. A drop in pressure can draw untreated groundwater into pipes, but drinking water remained safe, according to authorities. The Record ↗

There has not yet been a formal attribution in the U.S. case either. Iran is the main suspect, but authorities have not publicly identified it as the perpetrator. Separately, on 18 August the U.S. Justice Department charged seventeen Iranians with a broad cyber-theft campaign they allegedly conducted for the Islamic Revolutionary Guard Corps. Britain’s cyber security centre had earlier urged organizations to prepare for the risk of spillover damage in connection with the conflict involving the United States and Israel with Iran, and its head Richard Horne warned at the start of the year that hostile states, including Iran, were increasingly targeting British infrastructure. Tagesspiegel ↗

The Guardian places the incident in the context of possible Iranian retaliation against Britain for allowing the United States to use its bases. But that is contextual framing, not a documented motive. What remains verified is a narrow slice. The government confirmed an incident at a small electricity generator and did not deny the report of a four-day outage. However, it refused to say which facility was hit or who was responsible. Everything else rests on a single news report that other newsrooms have so far only picked up. The Guardian ↗