Is Iran attacking Western infrastructure? Hackers linked to Tehran cause power outage in UK

Hackers backed by the Iranian regime are suspected of forcing a small power plant in the United Kingdom to suspend operations for four days last month.

The incident, reported by Fox News following consultations with British security officials, highlights an escalation in Tehran's cyber tactics, which have shifted from simple infiltration to the physical disruption of critical infrastructure.

Despite the seriousness of the incident, British Energy Minister Michael Shanks sought to reassure the public about the stability of the national power supply: "To be clear: there was no threat to the wider grid and nobody lost power. We have one of the most resilient energy systems in the world."

From remote monitoring to physical disruption

The outage in the United Kingdom occurred just a few weeks after hackers compromised more than 30 community water systems in Minnesota, where they gained access to the technology that remotely monitors and controls water pumps.

Although local authorities have not publicly attributed this incident, reports based on U.S. officials and industry memos point to Iran as the primary culprit, although President Donald Trump publicly stated that he does not believe Tehran was behind the breach.

The vulnerability of these facilities lies in their reliance on internet-connected industrial control systems that allow for the remote management of physical equipment. Once inside the network, attackers can change passwords, block access for legitimate operators or alter the machinery's operating parameters.

In July, the FBI and the Environmental Protection Agency (EPA) warned of threat actors who had gained access to exposed programmable logic controllers in water systems in at least seven states, causing pressure drops and flooding.

Background on sustained cyber campaign

The activities of Iranian cyber networks against Western targets are not an isolated phenomenon.

In recent years, U.S. federal agencies have linked the cyber group CyberAv3ngers, affiliated with the Islamic Revolutionary Guard Corps (IRGC), to the intrusion into dozens of facilities using Israeli-made controllers, affecting water treatment plants, energy companies and healthcare organizations that were using factory-default passwords.

Added to this is the mass cyberespionage front. On Aug. 18, the U.S. Department of Justice indicted 17 members of an Iran-based firm for carrying out a cybertheft scheme that stole more than 31 terabytes of academic data and intellectual property belonging to universities, corporations and government agencies.