Stay informed with free updates
Simply sign up to the UK energy myFT Digest — delivered directly to your inbox.
Britain’s power companies have been put on alert after hackers thought to be affiliated with the Iranian regime shut down a small UK energy facility.
Energy bosses have been briefed by Britain’s security chiefs on the successful cyber attack “with advice, direction and next steps”, the government said on Sunday.
The attack took down one of the UK’s small gas-fired “peaker” plants, which generally have a capacity of about 15 megawatts and are connected to local electricity distribution networks, according to two energy industry executives with knowledge of the situation.
The UK has roughly 300 such plants, with a total capacity of between 4 gigawatts and 7GW. These plants usually have no employees on site and turn themselves on and off when they get a signal that more electricity is needed.
They are run by programmable logic controllers (PLCs) — industrial computers that monitor their operations and temperature.
“Because the plant was so small, there was no formal cyber security regime,” said one industry executive. “PLCs are a well-known vulnerability to hackers.”
The owner and location of the site have not been disclosed, but British officials did not deny a report in the Sunday Telegraph that the attack closed down the site for four days and that Iran-linked hackers were believed to be responsible.
Although the UK energy department insisted the attack was focused on a small plant with no significance to the national energy system, the National Cyber Security Centre, a branch of signals intelligence agency GCHQ, is involved in the response.
“In response to this specific incident, the NCSC and Department for Energy Security and Net Zero briefed energy CEOs and directly wrote to companies with advice, direction and next steps,” the government said.
Energy UK, the industry group, said it was “worrying news that the threat levels have increased and while there has been a welcome intervention from the government, it is clear we have a challenge on our hands to bring the UK’s infrastructure in line with the needs of the 21st century”.
The Telegraph reported that the incident took place at the same time as a series of attacks on US water infrastructure last month, which affected 12 states and caused concern in the White House.
UK officials declined to say where or when the cyber attack took place, but one insisted: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near.”
“It’s a very small-scale site, less than a rounding error compared to grid capacity,” the person added. However, the official confirmed that security officials and the government had been notified of the cyber attack.
The government said: “Plans are in place to ensure the resilience of UK energy supply in the highly unlikely event of significant disruption, regardless of the cause.”
The Iranian embassy in London did not immediately respond to a request for comment.
The attacks against US water systems last month were thought to be orchestrated by a group called CyberAv3ngers operated by Iran’s Islamic Revolutionary Guard Corps, which was proscribed in the UK last month.
They also attacked the PLCs that manage water pumps, pressure and treatment processes for water utilities.
The attackers gained access and changed passwords, locking the administrators out and forcing the facilities to shut down while they launched a reboot.
This Iranian group had been prowling around US infrastructure for several months, resulting in warnings from US authorities since as early as April.
UK cyber security officials stepped up warnings about the threat of Iran-linked hacking in March after US and Israeli attacks against Iran.
The NCSC said UK organisations “should prepare to respond to the risk of collateral impacts in the UK from Iran-linked hacktivists”, and told them to prepare for DDoS attacks, phishing and attacks on industrial control systems.
The UK government on Sunday said Britain had one of the most reliable electricity systems in the world and that it played a fundamental part in national security.
“We work continually to reduce the vulnerability of our energy infrastructure and ensure effective responses to disruptive incidents, taking account of a wide range of hazards and the evolving threat landscape,” it said.
Ministers are working on an Energy Resilience Strategy for publication later this year, which sets out a plan for ensuring the energy system remains resilient to risks including climate change, technological advancements and political threats.
The government said: “The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure high security standards.
“This story refers to an incident impacting a small-scale energy generator. At no point was there a risk to the wider energy system.”
