Loading story…
A reported Iran-linked cyberattack forced a small UK power generator offline for four days, marking a potential escalation in threats to connected industrial systems. The UK government confirmed that a small-scale generator was affected but said the wider electricity system was not endangered; it did not identify the facility or confirm whether operational-control systems were directly compromised. Reporting indicated attackers may have reached an internet-exposed programmable logic controller (PLC) using default credentials before changing its configuration and locking out access.
The incident follows National Cyber Security Centre reporting of more than 200 cyber incidents affecting UK critical infrastructure in the prior year, roughly three-quarters of which were believed to involve state actors. Organizations operating IT and operational technology should remove OT assets from public internet exposure, eliminate default credentials, enforce MFA and least privilege, segment IT and OT networks, tightly control remote access, prioritize high-risk patches, and test offline backups and incident-response procedures—including authority to isolate suppliers or disconnect affected systems.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
The NCSC reportedly warned that UK critical infrastructure experienced more than 200 cyber incidents over the preceding year, with around three-quarters believed linked to state actors.
Following the generator incident, the UK government and National Cyber Security Centre urged critical-infrastructure and industrial organizations to audit internet-facing devices and improve cyber hygiene, including removing exposed OT assets and eliminating default passwords.
Reporting indicated attackers scanned for internet-exposed PLCs, used default credentials to access them, and reset programming while changing passwords and IP addresses to make devices inaccessible. It remained unclear whether operational control systems were directly compromised or the plant was disconnected during IT incident containment.
A reported cyberattack attributed to Iranian hackers forced a small UK power generator offline for four days. Sources differ on whether the outage occurred in July or August; the UK government said the wider energy system was not at risk and did not identify the facility.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A small UK power plant was reportedly forced offline for four days after an intrusion attributed to Iran-linked hackers, marking what has been described as the first confirmed cyber-induced shutdown of a British power facility. The outage did not affect the broader electricity grid, but the incident was reported to the UK's National Cyber Security Centre and prompted warnings to energy operators about heightened risks to critical infrastructure. The activity coincided with a broader wave of suspected Iranian operations targeting water and wastewater systems in the United States, where officials linked attacks across 12 states to flooding, pressure loss, and boil-water advisories. In New Jersey, Hamilton Township Municipal Utilities Authority disclosed a cyber threat and said the extent of unauthorized access remained unclear, adding to concerns that water utilities are among the sectors facing sustained hostile probing and disruption.
Aug 28, 2026
Reporting highlighted growing concern that **state-affiliated and state-linked actors** are positioning for disruptive attacks against **operational technology (OT)** and critical infrastructure, with activity that may be difficult for operators to detect. A Codific analysis described five common pathways seen in disruptive grid-focused intrusions—often beginning with **human error or exposed perimeter services**, then escalating through **credential theft**, **remote access exploitation** (e.g., VPNs/gateways), **ransomware**, and misuse of **legitimate industrial commands** that can delay operations and complicate detection and recovery; it also warned that attacks on virtualized environments can hinder restoration efforts and that cascading impacts could be severe (e.g., Lloyd’s “Business Blackout” scenario estimating losses up to **$1T**). Recommended mitigations emphasized proven controls such as **phishing-resistant MFA** and **IT/OT segmentation**, rather than novel defenses. Separate commentary and media content also pointed to OT becoming a frontline in geopolitical escalation, including claims of a coordinated campaign tied to Iran-linked hacktivist activity targeting OT devices such as **Unitronics PLCs** used in water and industrial facilities, alongside psychological operations and SMS spoofing. Other items in the set were leadership/career/podcast-style content without specific incident or vulnerability detail and do not materially add to the OT/power-grid threat reporting.
Jun 29, 2026
Suspected Iranian hackers breached internet-exposed automatic tank gauge (ATG) systems at gas stations in several U.S. states, reportedly targeting **Veeder-Root** `TLS-350` and `TLS-450 Plus` consoles that lacked password protection rather than exploiting a newly disclosed flaw. Advisories said incidents affected sites in Tennessee, including one convenience store chain with 15 tanks impacted, and in some cases attackers deleted fuel tank and sensor data or altered system settings. Officials said no physical damage was reported, but security experts warned that compromised ATGs could enable fuel overfills, disable safety alarms, and cause environmental or equipment damage. The intrusions come amid a broader surge in attacks on operational technology across industrial sectors. NCC Group said industrial organizations suffered **2,073 ransomware attacks** in the 12 months to March 2026, accounting for **30% of all ransomware activity**, with manufacturers of capital goods, machinery, construction, and engineering among the hardest hit. The report said many organizations still prioritize IT defenses over OT security even as governments and regulators expand resilience requirements, while international authorities have issued procurement guidance to push stronger security controls into OT products and supply chains.
Aug 7, 2026