For four days a British power plant did not operate. Not because of a fault, not because of a storm, not because of a strike - but because somebody entered its systems from a distance and switched it off. Hackers linked to Iran, according to British sources, managed to halt electricity generation at a plant on UK territory. It is considered one of the most serious cyber strikes on the country's energy infrastructure to date.

The plant's name has not been released for security reasons. It is a relatively small facility, so the four-day outage caused no supply problems for the country. But that is not the point, and London knows it. The point is that the attackers got deep enough to physically stop the generation of electricity. They did not steal data. They did not take down a website. They switched off the power.

The first known case - and that is what is frightening

According to what has been published, this is the first known instance of hackers linked to the Iranian regime completely bringing down a British power plant. The details have not been released: it is not known how they got in, which parts of the infrastructure they compromised, or how much material damage they caused. Nor is it known whether they directly took control of industrial systems, or whether the plant was shut down as a precaution after the core network had already been breached.

That is the difference between the two scenarios nobody wants to name publicly. In the first, the attackers had their hands on the levers. In the second, the operator pulled the brake because it no longer knew who it could trust inside its own network. Neither is good news.

200 incidents in one year

The British National Cyber Security Centre said in June that over the previous twelve months it had responded to more than 200 cyber incidents affecting the country's critical infrastructure or the systems supporting it. Around three quarters of them are assessed as linked to state actors. Among the countries whose hacking groups are named as the greatest threat are Russia, China and Iran.

By critical infrastructure the British mean power plants, hospitals, airports, communication networks, water supply systems - everything without which a country simply stops. The centre had warned before that Iranian state and Iran-linked groups retain the capability for serious operations. The latest case showed the warning was not a theoretical exercise.

The same story across the Atlantic

The incident in Britain coincided with a series of attacks on infrastructure in the US. According to published information, Iran-linked attacks hit water supply systems in twelve American states, and at some locations there were serious problems with wastewater treatment plants and warnings about water safety.

That is why British services now believe the attack on the power plant may not be an isolated incident, but part of a broader wave of strikes on the infrastructure of countries Tehran considers adversaries. Companies have again been warned to strengthen protection of their key systems.

War without missiles

What this case demonstrated is simpler and more uncomfortable than any military analysis: to switch off a country's electricity, you no longer need missiles and bombs. Access to a computer system is enough. There is no front, no border that can be defended, no siren that sounds before the strike.

And here comes the question worth asking here rather than in London. Britain has a National Cyber Security Centre that responded to 200 incidents in one year - so somebody is counting, somebody is logging, somebody is warning. The question for our region is not whether such an attack is possible, but whether we would even notice if it happened. How many of the systems that bring us electricity, water and our link to the world have been audited in the past year, and who audited them?