This is a story to read for the lessons, not the fear, and it is not just for utilities. Iran-linked hackers took a UK power plant offline for four days — the first confirmed cyberattack of its kind against British energy infrastructure. It happened in July 2026, was broken by The Telegraph on 22 August, and the unnamed plant was restored by staff by hand over several days.
In parallel, a wave of attacks hit wastewater treatment plants across 12 US states: Minnesota first on 26 July, then Michigan, Georgia, South Dakota, and New Jersey, with physical consequences — flooding and loss of water pressure. The FBI attributes it to Iran-linked actors, likely the IRGC, and the point of the operation reads as a proof of concept: to show they can reach into infrastructure and switch it off at will.
This has happened before, and that is the point
It is the escalation of a long trend. In 2023-2024 the Iran-linked CyberAv3ngers hit US water utilities at scale by breaking into Unitronics Vision PLCs exposed to the internet with the default password 1111. US agencies have warned for years about Volt Typhoon pre-positioning inside critical infrastructure. Hitting OT is becoming a tool of geopolitical pressure, not a freak event.
Why OT breaks more easily than it looks
Operational technology (OT) lived for decades behind the myth of the “air gap.” That gap is gone:
- IT and OT merged for remote monitoring and maintenance, so the Purdue model that should separate levels is blurred. The attacker enters through IT or a contractor. From there they pivot into the process segment.
- Interfaces are exposed: HMI panels, engineering interfaces, and VNC/RDP found straight from the internet via Shodan, often with default passwords.
- Legacy you cannot patch: PLC firmware and SCADA servers built for reliability, not for an adversary, that you cannot update on a workday without stopping the process.
- Nobody watches process traffic: monitoring is tuned for IT, not ICS protocols, so an anomalous command to a controller goes unnoticed.
Why this matters for Cyprus — beyond power plants
Cyprus is not full of nuclear plants, but it is full of businesses with physical equipment a computer controls: manufacturing and food production, ports and logistics, hotels and buildings with BMS/HVAC, water and utilities, medtech. The same pattern — enter through IT, pivot into OT, an exposed interface — applies to all of them. And the consequences are not “a database leaked,” they are a halted process, damaged equipment, and a possible GDPR/NIS2 reportable incident. NIS2 in particular now pulls many mid-sized operators into scope they used to ignore.
What to do
- Real IT/OT segmentation with Purdue-model zones and a strict allowlist of what can reach controllers, on least privilege.
- Asset inventory and perimeter review: know which HMIs, VPNs, and engineering services are visible from outside and take them off the internet — what is not on your list, the attacker already found in Shodan.
- Remote-access governance for contractors: MFA, access brokers, logging, and revoking access when work ends.
- OT-specific monitoring and an OT incident-response plan, where “just reboot” is not an option and recovery can take days.
- Anchor to IEC 62443 and CISA/NCSC ICS guidance as a maturity checklist, and use it to evidence NIS2 diligence.
We help Cyprus organisations close these gaps: external and internal network penetration testing find the path from the corporate network to the process segment, IoT and embedded-device penetration testing checks the controllers and HMIs, and Red Team operations with an assumed-breach assessment test readiness against a real scenario. Get a fixed-price quote and we will assess your IT/OT perimeter.
Related service: OT / ICS / SCADA penetration testing — we validate IT/OT segmentation, PLCs, HMIs and the attacker’s path to the physical process.
Sources: The Telegraph; SecurityWeek, The Register, Help Net Security, SecurityAffairs, SC Media; FBI attribution. Context: CISA advisories on CyberAv3ngers/Unitronics and Volt Typhoon.