A cyber attack reportedly linked to Iran forced a small UK electricity generator offline for four days in July, prompting the government to brief energy companies on measures to strengthen their defences.
The incident was first reported by the Telegraph, which said hackers linked to Iran had penetrated the facility and caused it to shut down for four days in July. The identity and location of the generator have not been disclosed.1
However, the UK government has not publicly attributed the attack to Iran. Energy Minister Michael Shanks confirmed that a cyber incident had affected a small-scale generator but stressed that its significance to electricity supply had been limited.
“To be clear: there was no threat to the wider grid and nobody lost power,” Shanks said. “The generator in question is tiny especially compared to what most of us would class as a ‘power plant/station’.”2
The government subsequently briefed energy company executives and provided further security advice to companies. Shanks said officials were continuing to work with industry, regulators and the National Cyber Security Centre (NCSC) to assess threats and strengthen protection.3
Heightened threat
The incident comes amid heightened concern about the exposure of critical infrastructure to cyber attack.
Following the escalation of conflict in the Middle East earlier this year, the NCSC advised UK organisations to review their cyber security posture. At the time, it assessed that there was no significant increase in the direct cyber threat from Iran to the UK, but cautioned that the situation could change rapidly and said Iranian state and Iran-linked actors “almost certainly” retained some capability to conduct cyber activity.4
Simon Edwards, who runs cyber security testing company SE Labs, said the latest incident demonstrated the potential consequences for critical infrastructure.
“This attack underlines the very real threats cyber warfare can pose to critical national infrastructure,” he said. “Hostile nation states have more than enough malice and resources to fund and enable similar attacks in the future, that’s why it’s vital that the UK’s energy network ramps up its defences with immediate effect.”5
Graeme Stewart, Head of Public Sector at cyber security company Check Point, said the relatively small size of the generator should not obscure the wider implications if reports about the attacker’s identity and capabilities prove accurate.
“The fact that this was a relatively small generator and the wider grid was unaffected does not remove the threat,” he said. “The far more serious point is what the attackers appear to have demonstrated: an ability to get inside UK energy infrastructure and stop it working.”6
Energy cyber rules
The incident occurs at a time when the government appears to be moving to strengthen cyber regulation across the energy sector.
Earlier this month, the Department for Energy Security and Net Zero and Ofgem confirmed plans to develop baseline cyber resilience requirements for all Ofgem licensees and to review which downstream gas and electricity operators fall within the Network and Information Systems Regulations 2018.7
The government’s Cyber Security and Resilience Bill would also expand and strengthen the existing regulatory framework, including powers intended to enable ministers to direct regulated organisations to take proportionate action when an imminent or live cyber threat puts national security at risk.8
Shanks said the government was also preparing a wider Energy Resilience Strategy, due later in 2026.9
Notes
[1] The Telegraph, “Iranian hackers shut down UK power plant”, 22 August 2026.
[2] Reuters, “UK briefs energy chiefs after Iran-linked cyber attack reports”, 24 August 2026.
[3] Ibid.
[4] National Cyber Security Centre, “Alert: NCSC advises UK organisations to take action following conflict in the Middle East”, June 2026.
[5] Simon Edwards, SE Labs, comments supplied to the publication.
[6] Graeme Stewart, Head of Public Sector, Check Point, comments supplied to the publication.
[7] Department for Energy Security and Net Zero and Ofgem, “Whole energy cyber resilience requirements: reshaping cyber regulation in downstream gas and electricity”, government response, updated 5 August 2026. The government said it intends to develop baseline cyber resilience requirements for all Ofgem licensees and review the applicability of the NIS Regulations to the sector.
[8] UK Government, Cyber Security and Resilience (Network and Information Systems) Bill: Power to direct regulated entities, updated 30 June 2026. Government factsheet
[9] Reuters, op. cit.
