Iran-Linked Hackers Accused of First-Ever Cyberattack on UK Power Plant

Key Takeaways

• In July 2024, Iranian‑affiliated hackers temporarily disabled a small‑scale UK power plant by targeting its programmable logic controllers (PLCs).
• The same month, similar actors reportedly compromised water‑system PLCs in several U.S. states, causing pressure loss and flooding.
• Attackers used low‑sophistication tactics—scanning for exposed devices and exploiting unchanged default credentials—rather than advanced zero‑day exploits.
• Many PLCs worldwide were not built with modern cybersecurity in mind; thousands remain openly accessible on the internet.
• The UK’s National Cyber Security Centre (NCSC) reported managing over 200 cyber incidents against critical infrastructure in the past year, with roughly three‑quarters linked to hostile states such as Russia, China, and Iran.
• While the power‑plant outage did not affect the national grid, experts view the incidents as possible proof‑of‑concept steps toward more serious future attacks.
• Responsibility for securing PLCs largely falls on individual operators, many of whom lack dedicated cybersecurity staff.
• Strengthening default‑credential policies, network segmentation, and continuous monitoring are essential steps to mitigate similar threats.

Overview of the Reported UK Power‑Plant Incident
In July 2024, British media outlets The Telegraph and the Financial Times reported that a power plant in the United Kingdom was taken offline for approximately four days after a cyber intrusion attributed to Iranian‑linked hackers. The plant, described as a small‑scale facility, did not disrupt the country’s overall electricity supply, but the outage forced operators to manually restore control while technicians worked to reestablish normal operations. Neither the National Cyber Security Centre (NCSC) nor the plant’s owners publicly confirmed the incident, though multiple sources corroborated the timeline and the nature of the breach. The attack is notable because it represents the first publicly known case in which Iranian‑affiliated actors successfully shut down a power‑generation asset in the UK, even if only temporarily.

Technical Target: Programmable Logic Controllers (PLCs)
The intruders focused on programmable logic controllers, the specialized computers that act as the “brains” of automated industrial systems. PLCs regulate critical functions across energy generation, water treatment, manufacturing, transportation, and safety systems such as fire suppression and security gates. Because they operate in real‑time environments, any unauthorized manipulation can lead to immediate physical consequences—ranging from equipment damage to hazards that threaten public safety. Despite their ubiquity, many PLCs were designed decades ago, long before the modern threat landscape emerged, and consequently lack built‑in defenses against network‑based attacks.

Attack Methodology: Low‑Sophistication Tactics
U.S. officials and cybersecurity experts familiar with the UK incident emphasized that the hackers employed relatively simple techniques. Rather than deploying exotic zero‑day exploits, the actors scanned the internet for PLCs that were inadvertently exposed and then attempted to log in using default usernames and passwords that had never been changed. This approach resembles searching for unlocked doors rather than picking high‑security locks. The Cybersecurity and Infrastructure Security Agency (CISA) has highlighted that such credential‑based intrusion is a common vector for Iranian‑linked cyber groups targeting industrial control systems (ICS) worldwide.

Exposure of PLCs on the Open Internet
A 2024 scan conducted by independent cybersecurity researchers revealed thousands of PLCs accessible directly from the public internet, lacking basic protections such as firewalls or virtual private networks (VPNs). Industry estimates place the global PLC population anywhere between 12 million and over 70 million devices, many of which are legacy models manufactured in the late 1960s through the 1990s. Because these devices were never conceived with contemporary cybersecurity challenges in mind, they often ship with well‑known default credentials and minimal logging capabilities, making them attractive targets for opportunistic attackers.

Broader Iranian‑Linked Cyber Activity in mid‑2024
The UK power‑plant breach occurred alongside a series of similar intrusions targeting water‑system PLCs in several U.S. states, including New Jersey, Minnesota, Georgia, and South Dakota. In those cases, attackers reportedly locked out operators, leading to pressure losses and localized flooding. Although no group has formally claimed responsibility, analysts assess that the Iranian‑linked operations may be part of a coordinated campaign to test and refine techniques against less‑defended critical infrastructure before attempting more consequential strikes on high‑value targets such as nuclear facilities, major grids, or national‑level water supplies.

Official Responses and Attribution Challenges
When approached for comment, the UK’s NCSC neither confirmed nor denied the reported hacking incident, a typical stance when investigations are ongoing or when disclosure could jeopardize ongoing defensive efforts. U.S. officials, however, have been more vocal about the pattern of Iranian‑linked activity, noting that the same groups responsible for the 2022 cyberattack that crippled Albania’s government services have shifted focus toward industrial control systems. The lack of public attribution does not diminish the concern; rather, it underscores the difficulty of tracing state‑sponsored actors who often employ proxy infrastructure and false‑flag tactics to obscure their origins.

Implications for National Critical Infrastructure
The temporary shutdown of a UK power plant, even at a modest scale, highlights a strategic vulnerability: the reliance on legacy PLCs that are easily discoverable and weakly authenticated. If adversaries can repeatedly gain access to such devices, they could potentially coordinate simultaneous outages across multiple sectors—energy, water, transportation—amplifying the impact far beyond any single incident. Moreover, the use of these attacks as proof‑of‑concept exercises suggests that future operations may aim for higher‑impact outcomes, such as prolonged blackouts, contamination of water supplies, or disruption of emergency services.

Recommendations for Defending PLC‑Based Systems
To mitigate the risk posed by the observed attack patterns, stakeholders should adopt a layered defense strategy:

1. Credential Hygiene – Enforce mandatory changes of default usernames and passwords on all PLCs upon deployment and schedule regular rotation.
2. Network Segmentation – Isolate PLC control networks from corporate IT networks and the public internet using firewalls, unidirectional gateways, or air‑gap techniques where feasible.
3. Continuous Monitoring – Deploy intrusion detection systems (IDS) tailored to industrial protocols (e.g., Modbus, DNP3) to flag anomalous traffic or unauthorized login attempts.
4. Patch and Update Management – Although many legacy PLCs cannot be patched, operators should apply available firmware upgrades and consider replacing end‑of‑life devices with newer models that incorporate security features such as secure boot and encrypted communications.
5. Incident Response Planning – Develop and regularly exercise specific response scenarios for PLC‑focused cyber incidents, including manual override procedures and communication protocols with regulatory bodies.
6. Information Sharing – Participate in sector‑specific Information Sharing and Analysis Centers (ISACs) to receive timely threat intelligence about emerging PLC‑targeting campaigns.

Implementing these measures can significantly reduce the attack surface and improve resilience against both low‑sophistication credential‑based intrusions and more advanced future threats.

Conclusion
The July 2024 cyber incident that temporarily took a UK power plant offline serves as a stark reminder that critical infrastructure remains exposed to relatively simple yet effective cyber tactics. By exploiting exposed PLCs and unchanged default credentials, Iranian‑linked actors demonstrated an ability to cause operational disruption without needing sophisticated malware. The parallel targeting of water‑system PLCs in the United States underscores a broader pattern of probing and preparation. While the immediate impact was limited, the episode highlights the urgent need for asset owners to modernize security practices around legacy industrial control systems. Strengthening credential controls, segmenting networks, enhancing monitoring, and fostering cross‑sector collaboration are essential steps to safeguard the vital services that underpin daily life and national security. As threat actors continue to refine their approaches, proactive defense will be the key to preventing future disruptions that could cascade across multiple critical sectors.