Six days on, no British official has said Iran shut down that power generator

The Telegraph disclosed on Sunday 22 August that a small-scale UK electricity generator had been taken offline for four days in July, writing that “Iran shut down a British power plant for four days in an unprecedented cyber attack” and that it was “thought to be the first time” hackers affiliated to the Iranian government had closed such a facility in the UK. The paper named no source. The BBC, Guardian, Financial Times, CNBC and Times of Israel followed over 23–24 August; SecurityWeek is explicit that those accounts were “largely based on the Telegraph account.” The only government language on the record comes from a Department for Energy Security and Net Zero spokesperson, who told CNBC: “The story refers to an incident impacting a small-scale energy generator” and “At no point was there a risk to the wider energy system.” DESNZ did not attribute the incident to anyone.

SecurityWeek notes that “there has been virtually no information coming from the expected official sources, such as the NCSC.” DESNZ told CNBC it had briefed energy chief executives, written to companies advising next steps, and is updating its cybersecurity regulations. Robert M. Lee, chief executive of the industrial-security firm Dragos, is the only named specialist publicly pushing back, telling SecurityWeek: “The attribution of cyber attacks are sometimes obvious. And yet the job of an intelligence professional is to avoid bias and do the work.” Vendor commentary ran in the other direction: Euan Carswell, SOC team lead at Barrier Networks, told Intelligent CISO the incident “represents a real escalation and validates many of the prior warnings about the potential risk of state-backed hackers to critical national infrastructure,” while conceding that “the specifics of this attack are unclear.” His inference that the target was “likely a gas plant” is speculation, not reporting.

Assessment: The story is being consumed as an attribution when what exists is a leak. Every downstream “Iran did this” traces to one paper and one unnamed source, and the British state has had six days to endorse it and has not — which is itself the news. Read the incentives: a leak that lands without official ownership lets a government seed a threat narrative and update regulations without carrying the diplomatic cost of naming Tehran, and without disclosing what actually failed. Lee’s caution about false-flag susceptibility applies equally to the US water-sector incidents of late July. If NCSC never speaks, treat the attribution as unproven indefinitely, not provisionally.