--- title: "Iran-linked hackers shut down a UK power plant… | Firevault" description: "A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026#webpage", "url": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026", "name": "Iran-linked hackers shut down a UK power plant…", "description": "A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Iran-linked hackers shut down a UK power plant for four days", "item": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Iran-linked hackers shut down a UK power plant for four days", "description": "A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not.", "url": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-23T18:35:08.305377+00:00", "dateModified": "2026-08-23T18:35:08.305377+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 746, "keywords": "Iran-linked, Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened A small power plant in the United Kingdom was shut down for four days following a cyber attack, according to reporting by The Telegraph, later covered by the BBC. The attack is attributed to hackers affiliated with the Iranian regime and is described as the first successful intrusion of its kind against British power generation. Neither the government nor the National Cyber Securi", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Breaking News Updated as information becomes available Overview What happenedWhy a small generator mattersIran and the wider patternThe Firevault viewSourcesShareMore Resources [Knowledge Vault](/learn/knowledge)/ Insight Insight · 23 August 2026 · Breaking # Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Mark Fermor Director & Co-Founder, Firevault 4 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026&text=Iran-linked%20hackers%20shut%20down%20a%20UK%20power%20plant%20for%20four%20days%0A%0AA%20small%20British%20generator%20was%20taken%20offline%20for%20four%20days%20after%20an%20Iran-linked%20cyber%20attack%2C%20reported%20as%20the%20first%20successful%20intrusion%20of%20its%20kind%20against%20UK%20power%20generation.%20The%20grid%20held.%20The%20control%20layer%20did%20not.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026)[](mailto:?subject=Iran-linked%20hackers%20shut%20down%20a%20UK%20power%20plant%20for%20four%20days&body=A%20small%20British%20generator%20was%20taken%20offline%20for%20four%20days%20after%20an%20Iran-linked%20cyber%20attack%2C%20reported%20as%20the%20first%20successful%20intrusion%20of%20its%20kind%20against%20UK%20power%20generation.%20The%20grid%20held.%20The%20control%20layer%20did%20not.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026) ![A small gas fired power generation plant at dusk with darkened control panels, illustrating the four day shutdown after an Iran linked cyber attack](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) Insight Article record **Insight**Category **23 August 2026**Published **4 min read**Reading time **Mark Fermor**Written by A small gas fired power generation plant at dusk with darkened control panels, illustrating the four day shutdown after an Iran linked cyber attack Why it matters ## What this means for organisations holding critical data A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. In this analysis 1. 01 [What happened](#section-0) 2. 02 [Why a small generator matters](#section-1) 3. 03 [Iran and the wider pattern](#section-2) 4. 04 [The Firevault view](#section-3) 5. 05 [Sources](#section-4) **On this page**[What happened](#section-0)[Why a small generator matters](#section-1)[Iran and the wider pattern](#section-2)[The Firevault view](#section-3)[Sources](#section-4) ## What happened A small power plant in the United Kingdom was shut down for four days following a cyber attack, according to reporting by The Telegraph, later covered by the BBC. The attack is attributed to hackers affiliated with the Iranian regime and is described as the first successful intrusion of its kind against British power generation. Neither the government nor the National Cyber Security Centre has named the site, citing security reasons. The Department for Energy Security and Net Zero confirmed that the incident affected a small-scale generator and stated that at no point was there a risk to the wider energy system. The department has since contacted power companies to advise them on the risk of cyber attacks. The affected asset is one of a number of smaller gas generators that provide short-term power to the network when demand requires it. The incident is reported to have taken place last month, at around the same time as a series of cyber attacks on water infrastructure in several United States jurisdictions. ## Why a small generator matters The reassurance offered is accurate and narrow. The national supply was never at risk, because one small generator is not the grid. That is a statement about scale, not about security. What the incident demonstrates is that a hostile actor reached an operational technology environment and held it for four days. Four days is not a probe. It is dwell time, and it means the intruder had a working path into the systems that decide whether plant runs or stops. The same class of path exists across hundreds of distributed generation assets, water sites and industrial estates, most of which were connected for remote monitoring and maintenance rather than designed for adversarial conditions. Small assets are also the easiest to reach. They tend to carry the same remote access convenience as large sites with a fraction of the security staffing, and they are frequently managed by third parties on shared platforms. A single supplier relationship can therefore become a route into many sites at once. ## Iran and the wider pattern Iran has long been regarded as a capable cyber power. The Western security community has expected activity of this type in connection with the conflict involving the United States this year, and until now there has been comparatively little of it against United Kingdom infrastructure. This incident, alongside the reported attacks on United States water systems, suggests that the intent has moved from signalling to execution. Government policy is catching up. Cyber security regulation for the energy sector is being updated, and an energy resilience strategy is expected later this year. ## The Firevault view Mark Fermor, founder of Firevault, said: "Four days of lost generation is not a failure of monitoring. It is a failure of separation. If a remote path can start and stop plant, then whoever controls that path controls the plant, and no amount of detection changes that fact. Resilience begins by deciding which functions and which data are never reachable from a connected network." There are two problems in this incident, and they need different answers. The first is control of the operational layer. Remote access into generation, water and industrial systems is a business requirement, so the answer is not to remove it but to constrain it. Firevault Control enforces the boundary: defined access paths, enforced separation between the corporate network and the operational estate, and physical interlocks so that no single remote credential can command plant. The Firebreak® hardware range is built for exactly this environment, where availability and safety outrank convenience. The second is the recovery position. When an operator loses confidence in an operational environment, the question becomes whether a clean, verified configuration and gold copy exists somewhere the attacker never touched. If the master copy sits on a network that shares any path with the compromised estate, the recovery is a negotiation rather than a restore. [Offline Secure Storage](/offline-secure-storage)® holds that copy physically disconnected, so a four-day outage becomes a controlled restoration instead of an open-ended investigation. The plant was shut down for four days. With separation in place, that is an inconvenience. Without it, it is a rehearsal. ## Sources - The Telegraph, 22 August 2026: Iranian hackers shut down UK power plant - BBC News, 23 August 2026: Iran-linked hackers behind cyber attack that shut down power plant, reports say - Department for Energy Security and Net Zero statement as reported by the BBC About the author ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Physical disconnection removes the path an attacker needs Offline Secure Storage® holds a clean copy of your data on hardware that is physically disconnected, so an intrusion cannot reach it, encrypt it or delete it. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your data sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Command**Access windows and retrieval under your control **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/gta6-leaks-rockstar-2026.jpg) Insight ### GTA 6 leaks: a nightmare or a blip for the biggest video game of the year? Unreleased Grand Theft Auto 6 footage has appeared online ahead of Rockstar's official preview, and Take-Two is now in court seeking the identities behind the accounts sharing it. The game will still sell. The material that leaked can never be unseen. 22 Aug 2026 3 min ](/news/gta-6-leaks-rockstar-development-footage-2026)[ ![Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/nine-pbs-archives-cloud-vendor-shutdown-2026.jpg) Insight ### Nine PBS: 50 Terabytes of History Trapped by a Cloud Vendor That Closed A public broadcaster lost access to fifty terabytes of archival footage, spanning seventy years of regional history, when its cloud storage supplier suddenly went out of business. The files are still trapped in a Denver data centre. 18 Aug 2026 4 min ](/news/nine-pbs-archives-cloud-vendor-shutdown-2026)[ ![French tax authority breach exposes 678,000 taxpayers and the land registry behind them](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/french-tax-authority-dgfip-data-breach-2026.jpg) Insight ### French tax authority breach exposes 678,000 taxpayers and the land registry behind them France's Directorate General of Public Finances has confirmed that attackers used compromised access points to extract tax and cadastral data on 678,000 individuals and businesses. The same seller claims to have held a live session on the central land registry platform covering roughly 20 million people. 17 Aug 2026 3 min ](/news/french-tax-authority-dgfip-data-breach-678000-2026)[ ![Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg) Insight ### Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials, including more than 1.7 million records attributed to McDonald's. No platform vulnerability was needed. Valid credentials were enough. 17 Aug 2026 3 min ](/news/azure-credential-theft-campaign-employee-directories-2026)[ ![Taiwan hit by AI-assisted cyber attack as agents harvest 2,500 personnel records](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/taiwan-ai-assisted-cyber-attack-2026-v2.jpg) Insight ### Taiwan hit by AI-assisted cyber attack as agents harvest 2,500 personnel records Taiwan says AI-assisted attackers compromised at least 85 government accounts and extracted more than 2,500 personnel records before expanding into the island's nuclear safety agency and at least seven energy companies. The tooling was autonomous. The data was reachable. 17 Aug 2026 3 min ](/news/taiwan-ai-assisted-cyber-attack-government-agencies-2026)[ ![Shell investigates Cl0p data theft claim as engineering files are listed](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/shell-cl0p-data-breach-claim.jpg) Insight ### Shell investigates Cl0p data theft claim as engineering files are listed Shell has opened an investigation after the Cl0p ransomware group claimed the theft of around 89 gigabytes of internal data, said to include engineering drawings, facility photographs, project roadmaps and testing reports. Shell is one of dozens of organisations named in the same campaign. 16 Aug 2026 3 min ](/news/shell-cl0p-ransomware-data-theft-claim) Share this article Breaking News Insight 23 August 2026 4 min read ## Iran-linked hackers shut down a UK power plant for four days A small British generator was taken offline for four days after an Iran-linked cyber attack, reported as the first successful intrusion of its kind against UK power generation. The grid held. The control layer did not. ![Iran-linked hackers shut down a UK power plant for four days](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/iran-uk-power-plant-cyber-attack-2026.jpg) ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) Published by Mark Fermor , Director & Co-Founder Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026&text=Iran-linked%20hackers%20shut%20down%20a%20UK%20power%20plant%20for%20four%20days%0A%0AA%20small%20British%20generator%20was%20taken%20offline%20for%20four%20days%20after%20an%20Iran-linked%20cyber%20attack%2C%20reported%20as%20the%20first%20successful%20intrusion%20of%20its%20kind%20against%20UK%20power%20generation.%20The%20grid%20held.%20The%20control%20layer%20did%20not.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026)[](mailto:?subject=Iran-linked%20hackers%20shut%20down%20a%20UK%20power%20plant%20for%20four%20days&body=A%20small%20British%20generator%20was%20taken%20offline%20for%20four%20days%20after%20an%20Iran-linked%20cyber%20attack%2C%20reported%20as%20the%20first%20successful%20intrusion%20of%20its%20kind%20against%20UK%20power%20generation.%20The%20grid%20held.%20The%20control%20layer%20did%20not.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Firan-linked-hackers-uk-power-plant-shutdown-2026) [Read full article](https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/offline-secure-storage/what-is-oss) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)