A cyber attack left a small power generation facility in the United Kingdom offline for roughly four days during July 2026. The incident has been linked to hackers with suspected connections to Iran, although British authorities have not made any official attribution.
The attack targeted a small-scale generator with approximately 15 MW of capacity. The unit was used to bolster electricity generation during periods of high demand. Despite the prolonged outage at the site, no customers experienced power interruptions and the stability of the national grid remained unaffected.
The name of the operating company and the exact location of the plant have not been disclosed. Investigators have not released details about any malware, vulnerability, or method of initial access employed by the threat actors. There is also no public evidence that the intruders directly manipulated industrial controllers.
The four-day recovery period underscores the extensive validation required when restoring operational technology environments. Teams must thoroughly check controllers, system configurations, security controls, and remote access pathways before returning equipment to service.
Following the incident, UK authorities issued updated guidance to the energy sector and began discussions on additional safeguards for critical infrastructure operators and their suppliers.
