Hundreds of Britain’s smallest power plants may remain more exposed to state-backed cyber-attacks until the 2030s, despite an Iran-linked hack reportedly shutting a small gas plant for four days in July. The incident did not disrupt electricity supplies, but it has intensified concern that locally connected, unmanned generators have weaker security requirements than major power stations and grid assets.

Government plans require Ofgem to propose baseline cyber-resilience rules by the end of 2027, with implementation due by the end of 2030; the reported attack has not changed that timetable. The UK has hundreds of small gas plants used to boost supply during tight periods, while ministers have warned of four nationally significant cyber-attacks each week and critics have called for the rules to be accelerated.