Iran-linked hackers reportedly shut down a small British power plant for four days, marking what UK officials described as the most successful cyberattack of its kind on a UK power facility.

CBSNEWS reported the incident but withheld the name of the plant, citing security concerns to prevent further leaks or attacks.

The UK government clarified that the plant was small enough that the shutdown posed no risk to the wider power grid. Following the incident, energy company leaders were briefed and businesses were issued guidance on responding to cyberattacks.

The National Cyber Security Centre (NCSC), part of GCHQ, was notified of the attack. The NCSC performs functions comparable to India’s Computer Emergency Response Team (CERT-In), though their institutional mandates differ. The incident underscores the vulnerability of critical infrastructure to cyber intrusions and highlights the importance of sector-specific response mechanisms.

India has recently taken steps in this direction. On 31 July 2026, the Central Electricity Authority notified the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026.

These regulations propose the creation of a new CERT-In-like cybersecurity body called the Computer Security Incident Response Team for the Power Sector (CSIRT-Power). This initiative aims to strengthen India’s resilience against cyber threats targeting its energy infrastructure.

Attributing cyberattacks remains a complex challenge. As Nikhil Pahwa noted in 2019, cyberattacks can be launched from compromised devices across multiple countries or via proxies, making attribution to specific entities or nation states extremely difficult.

Unlike conventional military strikes, cyberattacks rarely involve claims of responsibility. An attack on a nuclear installation would normally be considered an act of war, but the ambiguity of cyber attribution complicates responses.

India has already faced several instances of cyberattacks targeting its critical infrastructure. In 2020, a China-linked group known as RedEcho reportedly targeted India’s power and maritime infrastructure during the border standoff. While some reports suggested a link to the October 2020 Mumbai blackout, this has not been officially confirmed.

In October 2019, malware infiltrated the internet-connected network of the Kudankulam Nuclear Power Plant, exposing severe vulnerabilities. Officials initially denied the reports before later acknowledging the infection.

More recently, in July 2026, data belonging to a Reliance Group company involved in contract work at Kudankulam was leaked on the dark web. Reliance confirmed a partial breach involving data stored on a server hosted by third-party provider Yotta.

The private sector is particularly vulnerable compared to government-controlled infrastructure. As Nandkumar Saravade, Saikat Datta and Anand Venkatanarayanan observed in 2023, many critical sectors such as transport, banking, and power are increasingly privatised, expanding the threat landscape beyond government entities.

Anand V has argued that India’s state cybersecurity capabilities are “non-existent at best.” He emphasised that sovereignty should be understood as capabilities, particularly supply chain control, rather than abstract notions of digital or AI sovereignty. Without ownership of the supply chain, sovereignty remains a mirage.

Public-private partnerships could provide a way forward. Sameer Patil of the Observer Research Foundation has argued that shared responsibility between public and private sectors is essential for protecting critical infrastructure.

Such partnerships should focus on building institutional frameworks, expanding capacity, creating security standards, enforcing strict audits, and evolving incident reporting mechanisms.

This collaborative approach could help India strengthen its defences against increasingly sophisticated cyber threats.

The Iranian-linked cyberattack on the UK’s power plant serves as a stark warning for India. With its growing reliance on digital systems and increasing privatisation of critical infrastructure, India must accelerate efforts to build robust cybersecurity capabilities.

The establishment of CSIRT-Power is a step in the right direction, but effective implementation, supply chain control, and public-private collaboration will be crucial to safeguarding strategic and critical assets.

Agencies