UK small power plants face growing cyber threat into 2030s

Britain’s small power plants are facing a sustained and growing cybersecurity crisis that experts say won’t be resolved until well into the 2030s — a stark warning that follows confirmation of an Iran-linked hack targeting the country’s energy infrastructure.

The attack, which security officials have attributed to hackers with ties to the Iranian government, exposed critical weaknesses in the systems that manage distributed energy assets across the UK. These include gas peakers, solar farms, battery storage units, and biomass facilities — many of which were built with little or no consideration for digital security threats.

Why small plants are the weakest link

Unlike large nuclear stations or major gas-fired power stations, smaller generation sites often run on legacy control systems that were never designed to be connected to the internet. But the shift toward smart grids and remote monitoring has forced that connection, creating vulnerabilities that are difficult and expensive to patch.

A senior official at the National Cyber Security Centre acknowledged the scale of the problem. “The energy sector’s smaller assets present a disproportionate risk relative to their size,” they said. “Attackers know that these sites are less likely to have dedicated security teams.”

There are roughly 2,300 small-scale power generation sites in Great Britain that feed into the national grid. Many operate with skeleton staff. Some are almost entirely automated.

Iran’s role and the wider threat landscape

The Iran-linked intrusion is believed to have targeted operational technology — the industrial control systems that physically manage equipment like turbines and inverters. It’s the kind of attack that, if fully executed, could cause real-world disruption rather than just data theft.

Analysts say the hack fits a pattern of Iranian cyber operations that have accelerated since 2022, increasingly focusing on critical infrastructure in Western nations. The UK is not alone. Similar probing attacks have been documented in the United States, Germany, and the Netherlands.

Still, the UK’s exposure is considered particularly acute given the pace at which it has been deploying decentralised renewable energy without matching investment in cybersecurity frameworks.

A timeline that offers little comfort

The problem isn’t going away quickly. Security analysts estimate that upgrading cyber defences across the UK’s distributed energy estate to an acceptable standard could take until 2033 or 2034, given procurement cycles, budget constraints, and the sheer number of sites involved.

And that timeline assumes consistent government funding — which isn’t guaranteed.

The Department for Energy Security and Net Zero has said it is working with Ofgem and the NCSC to develop new mandatory cybersecurity standards for energy asset operators. Consultation on those standards is expected to begin later this year.

But critics argue the process is moving too slowly. With the UK aiming to decarbonise its electricity grid by 2030, thousands more small renewable sites will come online in the next five years. Each one is a potential entry point. The window to get ahead of the threat is narrowing fast.