Iran conflict exposes growing cyber threat to critical infrastructure

The conflict involving Iran is highlighting a growing cybersecurity threat to critical infrastructure, with recent incidents affecting a British power plant and water systems across the United States raising concerns about how cyberattacks could disrupt essential services.

According to Graeme Stewart, a cybersecurity expert, the reported attacks offer a glimpse of how the conflict could expand into a wider cyber battlefield, with governments and businesses outside the Middle East potentially becoming targets, Al Jazeera reports.

Media reports that Iran-linked hackers forced a British power plant offline for four days have drawn attention to the vulnerability of energy infrastructure. The facility was relatively small, and the British government has stressed that there was no threat to the wider energy system. But the incident raises a broader question: what could happen if a much larger facility were targeted?

The concern extends beyond Britain. Water and wastewater systems in at least 12 US states have recently reported cyberattacks, with more than 30 community water systems affected in Minnesota alone. In Georgia, one incident caused a fall in water pressure and resulted in a boil-water advisory.

The US government has not publicly blamed Iran for the attacks, although reports have linked some activity to a hacking group associated with Iran’s Islamic Revolutionary Guard Corps.

The incidents point to a changing nature of cyberwarfare. For years, cyber threats were largely associated with stolen data, compromised accounts, financial losses or ransomware. Attacks on critical infrastructure present a different kind of danger because the systems under attack can directly control physical processes.

Electricity networks, water treatment facilities, transport systems and telecommunications increasingly depend on digital technology. That dependence creates efficiencies but also gives attackers potential routes into systems that keep essential services operating.

US authorities have specifically warned about Iranian-affiliated actors targeting internet-connected programmable logic controllers, or PLCs, which are used to control industrial equipment and processes. Activity has been identified across sectors including water, energy and government services, with some attempts reportedly causing operational disruption.

The geographical distance between an attacker and a target offers little protection in such circumstances. Infrastructure thousands of miles from a conflict zone can potentially become involved because of where it operates, the technology it uses, its suppliers or simply because an attacker identifies an opportunity.

Not every attack is necessarily intended to cause catastrophic damage. Cyber operations can be used to gather intelligence, disrupt services, gain publicity or create leverage. In some cases, the objective may simply be to demonstrate that a system can be penetrated.

That makes smaller incidents significant. Even when the immediate consequences are limited, gaining access to a facility can reveal information about an attacker’s capabilities and intentions.

Critical infrastructure is also interconnected. Electricity supports communications, healthcare, transport, finance and industry, while communications underpin emergency services and payments. Water systems themselves depend on electricity and digital controls. Disruption in one area can therefore create consequences elsewhere without requiring an entire national system to collapse.

The challenge is consequently not only preventing attacks but ensuring that essential services can continue operating when defences fail.

The FBI has advised affected US water utilities to practise reverting to manual controls if automated systems are compromised. The recommendation underlines a broader principle of infrastructure resilience: operators need to be prepared for situations in which technology becomes unavailable.

Governments and companies are now being urged to examine systems that are accessible from the internet, assess the security of suppliers and connected technologies, and prepare for the possibility that attackers could bypass existing defences.

The emerging lesson from the recent incidents is that cybersecurity is no longer only about protecting information. When digital attacks can interfere with electricity or water systems, cybersecurity becomes part of protecting the physical infrastructure on which societies depend.

The danger, Stewart argues, is discovering those vulnerabilities only after a major attack has begun.

By Aghakazim Guliyev