When a Power Plant Attack Was Inevitable, Resilience Could Not Be
James Griffiths, Principal Consultant and Founder of UtopianKnight Consultancy, has been quoted in Security Brief UK's report on the Iran-linked cyberattack against a UK power plant.
The report, published on 25 August 2026, follows weekend reporting that a British power facility was hacked and taken offline. The incident did not cause a national blackout, but it demonstrates why the security of critical national infrastructure cannot be judged only by the size of the immediate disruption.
“Inevitable” should mean prepared, not resigned
In the interview, I described an attack of this kind as unfortunately inevitable. That is not an argument for accepting compromise as normal or unavoidable. It is a warning that the threat has been understood for long enough that operators should already be planning for a determined adversary to reach an important operational environment.
A UK power plant hacked and linked to the Iranian regime was unfortunately inevitable. Although we don’t know which power plant was targeted and successfully shut down, what is clear is that this is a wake-up call for the rest of the critical national infrastructure community.
The practical question is therefore not whether every intrusion can be prevented. It is whether the organisation can detect what has happened, contain it without creating unsafe conditions, and restore essential operations with confidence.
Four days tells us to examine recovery
Security Brief UK reported that the affected plant took four days to come back online. Depending on the scale and nature of the attack, that could be a relatively quick recovery. It could also reveal how dependent restoration is on specialist people, unavailable systems, manual workarounds, or decisions that have never been tested under pressure.
Industrial recovery is not the same as restarting an office application. Engineers may need to verify safety controls, confirm the integrity of operational technology, and bring systems back in a sequence that does not introduce a second failure. Recovery time is therefore a security outcome in its own right, not just an operational metric recorded after the event.
Small sites can still have a wide blast radius
A smaller power plant may appear isolated, but its strategic importance depends on how it connects to the rest of the energy system. Shared suppliers, remote access, communications, control platforms, and grid interfaces can turn a local compromise into a route for wider reconnaissance or disruption.
Operators should understand which links are essential, which are trusted by default, and what an attacker could reach after compromising one site. That visibility matters just as much for smaller facilities as it does for the most recognisable power stations.
What energy operators should test next
- Map every connection between corporate IT, operational technology, suppliers, remote access, and grid-facing systems.
- Exercise a prolonged loss of normal systems and communications, including safe manual or alternate operating procedures.
- Measure how quickly the organisation can detect, contain, validate, and safely restore an affected process.
- Protect legacy assets with layered compensating controls where replacement or patching is not immediately practical.
- Share lessons from limited-impact incidents before the same weakness is used against a higher-impact target.
The warning from this incident is not that the UK grid is destined to fail. It is that resilience has to be designed for the systems that actually exist: older technology, complex dependencies, small operators, and a threat environment that will continue to test the edges of the network.