Britain runs dozens of peaker plants, many of them gas-fired and switched on for only a few hours a week, for instance when wind speeds drop [8]. The BBC's Tom Symonds reported that this was not an attack on an essential service of the kind a large station provides [10]. The rulebook reaches the same verdict: a government source told the Telegraph the site sits well below the level at which operators must legally report cyber activity, and called it "a very small-scale site, less than a rounding error compared to grid capacity" [9]. The National Cyber Security Centre, which sits under GCHQ and handles attacks on critical infrastructure, declined to comment, and it does not routinely acknowledge individual incidents in any case [6][7].
Why that class is worth attacking shows up on the American side of the same weeks. Most or all of the US utility intrusions involved internet-connected programmable logic controllers, the small computers that operate pumps and valves, according to The Register [17]. Five federal agencies warned last week that attackers are using AI-generated exploitation scripts against internet-exposed Siemens S7 controllers at water, manufacturing and energy sites, and said "this is not a theoretical risk, it is an active threat" [18]. Cynthia Kaiser, a former FBI cyber analyst now at the Halcyon Ransomware Research Center, told The Register the activity appears to be a continuation of the same suite of activity suspected of being affiliated with Iran targeting PLCs [19]. Where those controllers were attached to something people drink, the results were physical: dozens of wastewater plants affected, flooding, taps losing pressure, and boil-water advice to customers [13].
The scale of that campaign is still being assembled from disclosures rather than read off a register. The Telegraph put it at 12 states [12]. The Register counted more than 30 facilities in Minnesota with similar intrusions later reported in at least 11 other states, which totals at least 12 states once Minnesota is included [15][3]. CNBC reported that the FBI warning covered at least seven [16].
CISA, the FBI and the Environmental Protection Agency blamed Iran for the water intrusions, CNBC reported [16]. Britain has blamed no government or group [5], and the Iranian link on the generator rests on the Telegraph's reporting by Tony Diver, Rozina Sabur and Matt Oliver [2][3]. Officials declined to identify the station, citing security concerns [6]. What remains in the public record of four days of lost generation, then, is a newspaper story and one sentence from a spokesperson [1].
Last year the intelligence and security committee judged an Iranian cyber attack on British infrastructure unlikely, according to the Telegraph, while calling cyber warfare a significant area of asymmetric strength for Iran and noting that Tehran funds hacking groups of hundreds of people each [20][21]. Last month a Cabinet Office assessment put the chance of a serious and successful attack on domestic infrastructure at 5% to 25%, and warned that AI can automate the launching of attacks and lower the barrier to entry [22][23]. The July outage arrived within about a year of the unlikely judgement [4], at the one tier of the energy system where nobody was obliged to file anything.
