Cyberattack shuts down a small UK generator for four days

Iran’s IRGC called British bases hosting US forces ‘legitimate targets’

The incident

The Sunday Telegraph first reported a four-day shutdown of a small British power plant last month, attributing the cyber-attack to hackers linked to Iran.

Official response and NCSC information

A spokesperson for the UK Department for Energy Security and Net Zero told the Guardian: “This story refers to an incident impacting a small-scale energy generator, and at no point was there a risk to the wider energy system. The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.”

The National Cyber Security Centre (NCSC), which handles attacks on UK critical infrastructure, is understood not to have received any reported outages from regulated power-station operators. NCSC chief executive Richard Horne warned earlier this year that hostile states including Russia, China, and Iran are increasingly targeting the systems behind the UK’s key services.

Iran, British bases, the IRGC, and prior alleged cyberactivity

The Guardian reported the shutdown “marks an apparent escalation in the threat posed by Iran” following the UK’s permission for the US to launch “defensive” operations against Tehran from British bases. The UK government said last month it was “ready to defend itself” after Iran’s military warned that any bases being used by the US were “legitimate targets.”

Iran’s Islamic Revolutionary Guard Corps (IRGC) said last month that “any base used for aggression against Iranian territory constitutes a legitimate target for our forces.” According to the Guardian, the UK has allowed the US to launch so-called defensive operations from British bases hosting American planes since the start of the war on Iran but has refused to help in offensive operations. That policy has not been altered by the new prime minister, Andy Burnham, the Guardian reported. Burnham was notified last week that a decision had been made to extend the agreement with the US, according to the newspaper.

Iran has been accused in recent years of carrying out cyber-attacks on various countries, the Guardian reported, including in connection with a massive power outage in Turkey in 2015 and possible breaches of Israeli government websites in 2022. US government security agencies issued a warning earlier this year of cyber-attacks on critical infrastructure by hackers linked to the IRGC, and the US has alleged that an Iran-affiliated group known as “CyberAv3ngers” carried out a 2023 campaign that compromised at least 75 devices across multiple infrastructure sectors.