Iranian-Linked PLC Cyber Attack Shuts Down UK Power Plant

31 augustus 2026

Iranian-Linked PLC Cyber Attack Shuts Down UK Power Plant

A UK power plant has been forced offline following a cyber attack attributed to Iranian-linked threat actors, underscoring how rapidly PLC cyber attacks are moving from theoretical risk to operational reality. The intrusion reportedly combined stolen credentials with legitimate engineering software to manipulate programmable logic controllers (PLCs) , the devices that physically run turbines, valv

3 min readContent reviewed 1 October 2026

Detail

The UK outage is a proof point, not an isolated event. Iranian-affiliated actors have moved beyond IT espionage and are now directly manipulating controller logic to disrupt physical processes. For asset owners, the PLC is no longer a protected island , it is the primary target.

Industry reports indicate the UK power plant shutdown forms part of a broader campaign targeting programmable logic controllers and operational technology across critical infrastructure. Attackers are not exploiting a single zero-day; they are weaponizing weak authentication and the very engineering software operators rely on every day.

The modus operandi is familiar to defenders. Threat actors obtain valid credentials, connect through internet-exposed engineering interfaces, and then download malicious project files or alter controller logic. The result is physical disruption , pumps stop, breakers trip, or operators are shown falsified process data while the real state of the plant changes behind the scenes.

The Federal Bureau of Investigation (FBI), CISA, the National Security Agency (NSA), the EPA, the Department of Energy (DOE), Cyber Command (CNMF), and the Treasury have issued urgent joint advisories warning that Iranian-affiliated actors are actively exploiting internet-connected OT devices, including programmable logic controllers. The documented activity spans multiple critical infrastructure sectors and has already produced operational disruption and financial loss.

Security analysts describe the exploitation in three steps: the attackers reach the controllers, copy the process blueprint, and change what human operators see. This narrow slice is exactly what they manipulate , no need to breach an entire enterprise network when a single exposed PLC provides direct access to the physical process.

Observed targeting spans common industrial protocols: Port 22 (SSH), Port 102 (ISO-TSAP, used by Siemens STEP 7 and S7comm), Port 502 (Modbus TCP), and Ports 2222/44818 (EtherNet/IP, commonly associated with Rockwell Automation/Allen-Bradley controllers).

For the industrial automation market, the outage is a forcing function. PLC cyber attacks are no longer a niche IT concern; they are a board-level operational risk that reshapes how OEMs, integrators, and end users design and procure control systems.