The incident occurred around the same time authorities in the United States issued warnings about malicious actors targeting water and wastewater utilities.  

Markus Mueller, Field CISO at Nozomi Networks, comments, “This is a major escalation from the recent campaign targeting water utilities in the U.S. Unlike in water utilities, in power generation, especially a peaker plant things happen fast, there is no buffer, and there can be major impacts. That is what they are designed to do: come online quickly and provide a relatively small amount of power (less than 50 MW or ~25,000 homes) to stabilize the grid. This is the type of facility that a capable adversary that understands the systems could cause real damage to. If—and it’s a big if—the adversary had access to the primary control system at the plant.

“I’ve spent a fair amount of time in my career working at and securing peaker plants. There are often multiple control systems managing different parts of the plant, from the fuel system to the turbine control or boiler systems to the electric protection relays. There are often even meter and environmental monitoring systems. Sometimes these are connected together, but often they are not. What was impacted matters to safety and reliability. Reports indicate that the attack path involved a PLC that was not secured following basic best practices. This could have been one of the ancillary systems, not the main control system. This is not to say it’s not important to run the plant. For example, if the PLC was connected to a well or water storage tank and an attacker takes it offline, it still will cause the plant to shut down. However if an adversary can get into the main control system that runs the turbine or boiler there is a greater safety risk.”

While the U.K. spokesperson declined to attribute blame for the cyberattack, many suspect Iranian involvement. 

“There is currently a real gap in knowledge of what occurred,” Mueller points out. “Reporting is associating this Iran threat groups tied to the recent water utility cyber attacks in the U.S. and the timing lines up. Some reports are even attributing it to the Iranian Revolutionary Guard Corps (IRGC) hacking unit known as CyberAv3ngers. While the attribution is important to leadership, for those on the ground, what matters is the how. 

“If current reporting is correct this was a publicly exposed PLC that was impacted similar to what we have seen at U.S. water utilities, where the threat group scans the internet for exposed PLCs using AI generated scripts then logs into those PLCs using default credentials and proceeds to take the PLC offline by resetting the programming, changing the password, and changing the IP address (making it inaccessible), the hope is that the UK’s National Cyber Security Centre (NCSC) will put out a report similar to what CERT Polska put out for the Poland Energy attacks in December 2025. This will allow defenders to gain the insights they need to learn from this event.” 

U.K.’s Department of Energy Security stated it intends to update cybersecurity regulations.

Mueller concludes, “Regardless of whether this ends up being an improperly secured device or a more targeted attack that used a multi-step attack path, this is a major escalation that has greater safety and reliability concerns. Utilities and communities need to focus on getting their house in order, as they say. If utilities need help doing this there are great resources out there, including government organizations like NCSC as well as vendors.”