Government Communications Headquarters (GCHQ) has put energy companies on high alert after Iranian hackers shut down a British power plant.
Government officials have briefed energy bosses with “advice, direction and next steps” after a cyber attack forced a power-generation plant offline for four days.
The attack is believed to have been carried out in July by an Iranian Revolutionary Guard Corps (IRGC) hacking unit known as CyberAv3ngers, the FT reported.
On Sunday, a government press officer said that GCHQ’s National Cyber Security Centre (NCSC), together with the Department for Energy Security and Net Zero, had briefed chief executives because of the Iranian attack, which was revealed by The Telegraph.
“Plans are in place to ensure the resilience of UK energy supply in the highly unlikely event of significant disruption, regardless of the cause,” they said.
Officials have declined to identify the target of the hack.
The Conservatives called for a renewed crackdown on Iran in response to The Telegraph’s revelations.
Sanctions demand
Priti Patel, the shadow foreign secretary, said the attack showed how Iran was “plotting to attack our critical national infrastructure”.
“The Government needs to urgently review the Iranian risks to the UK, stop dithering, take action against the groups involved – as they have the national security powers to do so – and sanction without hesitation the Iranian officials responsible for these state-sponsored threats to Britain,” Ms Patel said.
Claire Coutinho, the shadow energy secretary, added: “Leaving ourselves reliant on imports of gas and electricity, and failing to build enough reliable gas or nuclear plants for back-up at home, all leaves us more vulnerable to this new kind of warfare.”
The Government has said it intends to pass a new Cyber Security and Resilience Act, which would tighten legal thresholds for power-plant operators to report suspected cyber attacks to the NCSC.
Chiefs briefed
No cyber security incidents affecting the energy sector were reported to officials in 2024 under the Network and Information Security Regulations, according to research by the Turing Institute.
Dating from 2018, those regulations were intended to give the Government greater visibility over cyber threats to critical national infrastructure.
Michael Shanks, the energy minister, said: “After the incident, we briefed energy chief executives and shared further advice with companies on the steps they should take to stay secure.
“We work continually with industry, regulators and the NCSC to assess threats and strengthen protections.
“The generator in question is tiny especially compared to what most of us would class as a ‘power plant/station’. That being said, the generator and the Government took the incident seriously.”
Specialist hackers
Last month, the UK imposed financial sanctions on the IRGC, which is the paramilitary wing of Iran’s ruling Islamist theocracy, after years of pressure from MPs. It is not known whether the Iranian cyber attack directly influenced the Government’s decision.
CyberAv3ngers is the self-assigned online nickname for the IRGC’s Cyber Electronic Command (IRGC-CEC). They have previously posed as the kind of young anarchic hackers who have menaced large companies such as Microsoft and Amazon over recent years.
Hackers from the unit specialise in attacking programmable logic controllers, which are pieces of software-controlled equipment used across industrial sectors ranging from energy and water to healthcare and food. They are extensively used across the electricity generation sector.
The US sanctioned the IRGC-CEC in 2024 and a $10m (£7.4m) FBI bounty is on the heads of six of its most senior operatives.
A government spokesman said the UK has a “highly resilient energy system”, adding that “at no point was there a risk to the wider energy system” from the Iranian hack.
