UK’s small power plants face continued cyber risk after Iran-linked hack

Decision not to improve resilience sooner described as ‘unacceptable gamble with our national security’

Hundreds of Britain’s smallest power plants could remain at a higher risk to state-sponsored cyber-attacks until the 2030s despite a successful Iran-linked hack last month, it has emerged.

Officials this week briefed energy bosses on the breach, which is understood to have shut an unnamed small gas power plant for four days last month, and put the industry on alert over the growing cyber threat facing energy infrastructure.

However, the government’s own plan to toughen the baseline cybersecurity standards for Britain’s smallest power generators will not be required until the end of 2030, raising concerns over “an unacceptable gamble with our national security”.

Official government documents, published this month, call for the industry regulator, Ofgem, to lay out proposals for new baseline cyber resilience requirements for gas and electricity infrastructure by the end of 2027, ahead of implementing new standards by the end of 2030. The Guardian understands that the hack has not altered this timeline.

The new requirements would cover the type of small-scale gas plant which is understood to have been successfully attacked by the Iran-linked hackers in the weeks before the government set out its timeline for bolstering the sector’s cybersecurity standards.

Reports of the unprecedented cyber hack emerged as the Cabinet Office prepares to urge UK citizens to stock up on tinned food and bottled water to prepare for extreme weather events and potential attacks from hostile states.

Calum Miller, the Lib Dems’ foreign affairs spokesperson, said: “Leaving hundreds of small power generators exposed to cyber threats until the 2030s is simply an unacceptable gamble with our national security.”

Britain has hundreds of small-scale, unmanned gas plants connected to local power grids which are typically idle for most of the year but can be used to ramp up generation when electricity supplies are squeezed.

Although the outage had no impact on the electricity system, the attack has raised concerns about vulnerabilities in locally connected power infrastructure which is not required to meet the same security standards as large-scale power plants and transmission assets.

“The government should not have to wait for the lights to go out before taking the security of our energy infrastructure seriously,” Miller said. “They must immediately fast-track these regulations, not leave them until the 2030s. We mustn’t leave an open goal to hostile states at a time of heightened global threats.”

The government opened a consultation into the cyber resilience of power generators in March, after it introduced the cyber security and resilience bill to parliament late last year, with a warning that the UK now faces four nationally significant cyber-attacks every week.

Michael Shanks, the energy minister, said in the consultation that the UK “needs to keep pace with the current threat landscape”.

An industry source familiar with the post-attack industry briefing confirmed reports, which first appeared in the Sunday Telegraph, that the plant was shut down for about four days in one the most successful cyber-attacks on UK energy infrastructure.

“We should use it as a warning rather than wait for an incident,” according to Rafael Narezzi, chief executive of Centrii, an energy cybersecurity specialist.

“Across the UK energy system we have small, medium and large generation assets, increasingly connected through digital systems, remote access, third parties and operational technology. This particular incident may not have had consequences for the wider grid, but the next one could be different.”

“What concerns me about this incident is not necessarily the size of the power generator that was affected, but how many others may be out there,” Narezzi added. “Attackers do not necessarily select their targets according to how many megawatts they generate. They look for vulnerabilities, trusted access and opportunities.

“The UK has thousands of distributed assets increasingly contributing to how our energy system operates. Individually, many may appear insignificant. Collectively, their resilience matters enormously.”

A government spokesperson said: “The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.

“We are alive to growing cybersecurity threats, which is why we also committed to reviewing the cyber resilience requirement for the downstream gas and electricity sector and are driving this work forward through parliament,” they added.