This one is worth breaking down for the lessons, not the scare, because it is about everyone with physical equipment, not just utilities. Iran-linked hackers took a UK power plant offline for four days — the first confirmed cyberattack of its kind against British energy infrastructure. The incident happened in July 2026, was broken by The Telegraph on 22 August, and the plant, unnamed for security reasons, was restored by staff by hand over several days.
Running in parallel, and not by coincidence, was a wave of attacks on wastewater treatment plants across 12 US states: Minnesota raised the alarm first on 26 July, followed by Michigan, Georgia, South Dakota, and New Jersey. The consequences were physical and tangible — flooding and loss of water pressure. The FBI attributes the incidents to Iran-linked actors, likely from the IRGC, and the probable point of the whole operation was a proof of concept: to demonstrate they can reach into infrastructure and switch it off at will.
This has happened before, and that is the point
Attacks on water and energy are not a bolt from the blue, they are the escalation of a long-running trend. In 2023-2024 the CyberAv3ngers group (also Iran-linked) hit US water utilities at scale by breaking into Israeli Unitronics Vision PLCs — and got in the dumb way, through internet-exposed controllers with the default password 1111. Separately, US agencies have spent years warning about Volt Typhoon pre-positioning inside US critical infrastructure “just in case.” Layer on the Israel-Iran cyber conflict spilling over onto allies, and the picture is clear: hitting OT is becoming a tool of geopolitical pressure, not a rare freak event.
Why OT breaks more easily than it looks
Operational technology (OT), the industrial control systems behind physical processes, lived for decades behind the myth of the “air gap.” In practice the gap is long gone, and here is why:
- IT and OT have merged. For remote monitoring, maintenance, and reporting, control networks were wired into corporate ones. The Purdue model that is supposed to separate the levels is blurred on real sites. The attacker enters through the ordinary IT perimeter or a contractor, then pivots into the process segment.
- Interfaces are exposed. HMI panels, engineering web interfaces, and VNC/RDP to them are routinely found straight from the internet via Shodan, often with default or weak passwords. Thousands of ICS devices are publicly reachable right now.
- Legacy you cannot patch. PLC firmware and SCADA servers were designed for reliability and predictability, not for an adversary, and you cannot just update them on a workday without stopping the process.
- Nobody watches the process traffic. An anomalous command to a controller often has no one and nothing to notice it — monitoring is tuned for IT, not for ICS protocols.
Why this is not just a utility problem
The temptation to shrug it off — “that is a power-plant problem” — is the core mistake. The same pattern (enter through IT, pivot into OT, an exposed interface) works just as well against any manufacturing, logistics, utilities, data centers with their cooling systems, buildings with BMS/HVAC, and medtech with physical equipment. If you have hardware a computer controls, you have OT risk. And physical consequences are not “a database leaked,” they are a halted process, damaged equipment, and in the worst case a threat to people.
What to do
- Real IT/OT segmentation: Purdue-model zones, unidirectional gateways where feasible, and a strict allowlist of what can reach controllers at all, on a least-privilege basis.
- Asset inventory and perimeter review: know cold which HMIs, VPNs, and engineering services are visible from outside, and take them off the internet. What is not on your asset list, the attacker already found in Shodan.
- Remote-access governance for contractors and maintenance: MFA, access brokers, logging, and revoking access when the work is done.
- OT-specific monitoring and an OT incident-response plan, where “just reboot it” is not an option and recovery can take days, as in the UK case.
- Anchor to standards like IEC 62443 and CISA/NCSC guidance for ICS — not for a checkbox, but as a maturity checklist.
We help close exactly these gaps: external and internal network penetration testing find the path from the corporate network to the process segment, IoT and embedded-device penetration testing checks the controllers and HMIs themselves, and Red Team operations with an assumed-breach assessment test your readiness against a real scenario rather than a paper one. Get in touch and we will assess your IT/OT perimeter.
Related service: OT / ICS / SCADA penetration testing — we validate IT/OT segmentation, PLCs, HMIs and the attacker’s path to the physical process.
Sources: The Telegraph reporting; SecurityWeek, The Register, Help Net Security, SecurityAffairs, SC Media; FBI attribution. Historical context: CISA advisories on CyberAv3ngers/Unitronics and Volt Typhoon.