Iran-linked hackers are suspected of disabling a small British power generator for four days last month, an incident that U.S. officials suggest may signal a new phase in cyber activity targeting Western infrastructure. This event follows a series of cyberattacks that impacted more than 30 community water systems in Minnesota.
While British officials stated the incident posed no threat to the broader energy grid and resulted in no power outages for the public, the disruption at the "tiny" generator has prompted security briefings for energy sector leaders.
The attacks on U.S. water systems, which occurred weeks before the British power generator incident, targeted technology used for remote monitoring and control of equipment. Although Minnesota officials have not publicly assigned blame, news outlets citing U.S. officials and a leaked industry memo have pointed to Iran as the likely perpetrator.
These incidents underscore concerns that civilian infrastructure, particularly water and energy facilities, could become a focal point in the ongoing geopolitical tensions between the U.S. and Iran. Such facilities often utilize industrial control systems connected to the internet, enabling remote management but also creating potential entry points for cyber actors. Once accessed, these systems can be manipulated to disrupt operations, lock out human operators, or interfere with machinery.
Federal agencies, including the FBI and the Environmental Protection Agency, previously alerted utilities to malicious actors targeting water and wastewater systems in at least seven states. These attacks involved gaining access to exposed programmable logic controllers, altering internet addresses, and changing passwords, leading to operational disruptions such as pressure loss and flooding. Warnings have also been issued about Iranian-affiliated actors specifically targeting industrial control devices within the water, energy, and government sectors.
This is not the first time Iranian hackers have been linked to attempts to compromise U.S. infrastructure. In 2016, the Justice Department charged an Iranian hacker with accessing the control system of a dam in New York, though an ongoing maintenance disconnection prevented any significant impact. More recently, U.S. agencies have associated an IRGC-affiliated campaign known as CyberAv3ngers with the compromise of Israeli-made industrial controllers at numerous U.S. facilities, including water and wastewater systems, energy companies, and healthcare organizations. These compromises often exploited devices that remained accessible via the public internet and were still using default passwords.
The recent incidents highlight the potential for significant physical disruption from relatively limited cyber intrusions. The attacks in Minnesota, for example, affected systems responsible for monitoring water levels, pressure, and pump operations, forcing some communities to revert to manual operations. The four-day shutdown in Britain demonstrates how even a small, accessible industrial system can be disrupted, causing physical effects without necessarily triggering a large-scale blackout or inviting immediate military intervention.