Cyber Incident Disrupts UK Generator for Days, Raising Concerns About OT Security
Summary
A cyber incident left a small UK generator unavailable for several days. The attack method, extent of OT access, and reported Iran-linked attribution remain unconfirmed, highlighting risks to remotely managed energy infrastructure.
Key points
- A cyber incident in July 2026 left a UK electricity generator, reportedly a roughly 15 MW gas-fired peaking plant, unavailable for several days.
- Authorities said the incident did not threaten the wider grid or cause customer outages; the operator and location have not been disclosed.
- The intrusion path and technical impact are unknown. Public evidence does not establish direct manipulation of plant equipment or PLCs.
- Media reports have linked the incident to Iran, but no public NCSC advisory has identified a group, malware, exploited vulnerability, or forensic evidence supporting attribution.
- The article places the event amid reported targeting of internet-connected PLCs and other industrial systems in the UK and United States, without establishing a link between those campaigns and the UK incident.
- Recommended safeguards include removing unnecessary internet exposure to OT assets, strengthening and logging remote access, validating IT/OT segmentation, monitoring controller changes, securing third-party access, and testing recovery procedures.
Article Details
- Event Type
- Cyber incident affecting a small UK electricity generator, resulting in several days of operational unavailability. The incident's cause and attack path remain unknown.
- Impact
- The facility was reportedly unavailable for approximately four days. UK authorities confirmed no threat to the wider grid and no customer outages. The operator, location, affected technology, and extent of any OT compromise have not been disclosed.
Threat Actors
CyberAv3ngersDescribed as an IRGC-linked group that has targeted internet-accessible PLC and HMI systems, including devices in the United Kingdom; not established as responsible for the July 2026 UK incident.Russia's FSB Centre 16Identified by UK and international partners as responsible for an attempted December 2025 attack against Poland's energy grid; not linked to the UK generator incident.
Vendors
Rockwell AutomationAn update on 22 July expanded the observed equipment scope to include Rockwell Automation, Schneider Electric, and Siemens controllers.Schneider ElectricAn update on 22 July expanded the observed equipment scope to include Rockwell Automation, Schneider Electric, and Siemens controllers.SiemensAn update on 22 July expanded the observed equipment scope to include Rockwell Automation, Schneider Electric, and Siemens controllers.
Products
MicroLogixThe FBI and EPA reported compromises of internet-facing Rockwell Automation MicroLogix PLCs, with attackers changing passwords and IP configurations, causing loss of monitoring or control and, in some cases, operationalS7On 19 August 2026, the NSA, CISA, FBI, Department of Energy, and EPA issued another warning concerning active targeting of Siemens S7-series PLCs across critical sectors, including energy generation and distribution.
Countries
PolandUK and EU formally attribute December’s cyber-attack against Poland's energy grid to Russian actors.United KingdomUK and international authorities have documented activity associated with the IRGC-linked CyberAv3ngers group targeting internet-accessible PLC and HMI systems, including devices in the United Kingdom.United States
Industries
EnergyHow did a cyber breach at a small UK peaking power plant highlight operational technology vulnerabilities across distributed energy infrastructure?GovernmentA cyber incident affecting a small UK electricity generator in July 2026 resulted in several days of operational unavailability and triggered a government and NCSC response.Water and wastewaterA separate wave of attacks began on 27 July, affecting water and wastewater utilities in at least seven U.S.