Iran-Linked Cyber Attack Disruption at UK Power Facility

Affected Environment
A small UK gas-fired power generation site with internet-exposed OT devices and default vendor credentials on PLCs and HMIs.

Threat Overview
Suspected Iran-linked hackers took the site offline for four days, alongside a wider campaign hitting US water utilities in 12 states.

Exposure Timeline
Incident occurred in late July 2026, alongside CISA's AA26-097A advisory update on 22 July 2026 covering the wider campaign.

Attack Surface
Internet-exposed PLCs and HMIs reachable without a VPN or authenticated jump host, using default or reused vendor credentials.

Technical Root Cause
Opportunistic scanning for exposed controllers combined with default credentials, plus tampering with reusable PLC code modules in some cases.

Exploitation Pathway
Attackers scan for internet-exposed OT devices, log in with default credentials, then manipulate or disable pumps, valves or generation controls.