427 or 4 Devices?: Measuring Internet-Exposed Industrial Infrastructure in the UK
Brief
By Adrian Cheek, Senior Cybercrime Researcher
On August 22, 2026, The Telegraph reported that a small UK power generator had been shut down for four days in July following a cyberattack by hackers linked to Iran. The government confirmed that a small-scale energy generator was affected, said the wider energy system was never at risk, and declined to identify the site.
The incident was reported to the National Cyber Security Centre, and the Department for Energy Security and Net Zero briefed energy company chief executives and sent guidance to businesses.
Within days, researchers began examining internet-wide scanning data for exposed industrial control protocols and publishing counts of what they found. The exercise is reasonable, but the assumption that the resulting numbers describe a single, measurable population is not.