UK’s small power plants face higher cyber risk into 2030s despite Iran-linked hack

Decision not to improve resilience sooner described as ‘unacceptable gamble with our national security’ Hundreds of Britain’s smallest power plants could remain at a higher risk to state-sponsored cyber-attacks until the 2030s despite a successful Iran-linked hack last month, it has emerged. Officials this week briefed energy bosses on the breach, which is understood to have shut an unnamed small gas power plant for four days last month, and put the industry on alert over the growing cyber threat facing energy infrastructure. However, the government’s own plan to toughen the baseline cybersecurity standards for Britain’s smallest power generators will not be required until the end of 2030, raising concerns over “an unacceptable gamble with our national security”. Official government documents, published this month, call for the industry regulator, Ofgem, to lay out proposals for new baseline cyber resilience requirements for gas and electricity infrastructure by the end of 2027, ahead of implementing new standards by the end of 2030. The Guardian understands that the hack has not altered this timeline. The new requirements would cover the type of small-scale gas plant