A power plant outage is an SME warning, not just a national-security story
Reports that Iran-linked hackers forced a UK power plant offline for four days should make every UK small and medium-sized enterprise reconsider one dangerous assumption: that a cyberattack on critical infrastructure is too large, specialised or politically motivated to affect their business.
The reported incident concerns a power plant, where operational technology (OT) and industrial control systems are central to physical operations. Most SMEs do not run turbines, substations or control rooms. Yet they rely on electricity, telecommunications, cloud platforms, payment terminals, refrigerated storage, logistics software and third-party suppliers that do. A prolonged disruption to one essential service can quickly become a revenue, contractual and customer-service crisis for a small business.
It is important not to infer more than the reporting establishes. Attribution in cyber incidents is technically and politically difficult, and the source describes the attackers as Iran-linked rather than definitively acting on behalf of the Iranian state. For an SME, however, the immediate practical lesson is not the identity of the attacker. It is that cyber risk can create a physical interruption lasting days, and that resilience planning and insurance must be designed around the resulting business impact.
Why this event changes the risk conversation for UK SMEs
Cyber incidents can stop trading without stealing customer data
Many firms still view cyber insurance primarily as protection after a data breach: customer notification, forensic investigation and regulatory advice. Those protections matter, especially under UK GDPR. But the most severe cost from a major infrastructure attack may be business interruption rather than stolen information.
Consider a small manufacturer whose computer-controlled machinery cannot restart after a power instability, a restaurant that loses chilled stock during an extended outage, or an accountancy practice unable to access cloud-based records and deadlines. In each case, the business may suffer lost turnover, overtime costs, spoiled stock, reputational damage and disputes with customers. None necessarily begins with the SME itself being hacked.
This creates an important distinction in cyber insurance wording:
- Direct cyber business interruption generally responds when a covered cyber event affects the insured's own systems.
- Contingent business interruption may respond when a covered event affects a named or qualifying supplier, service provider or outsourced technology provider.
- Utility service interruption can be covered under some property or business interruption policies, but the triggers, exclusions and waiting periods vary substantially.
A cyber policy will not automatically pay simply because electricity supply fails after a cyberattack elsewhere. Whether cover applies depends on the policy's definition of a security failure, whether physical damage is required, whether an external service provider is covered, and any war, terrorism, infrastructure or systemic-event exclusions.
Systemic events expose coverage gaps
A four-day power plant outage illustrates what insurers call aggregation or systemic risk: one event affects many policyholders at the same time. The same issue arises when a widely used cloud service, payment processor, managed service provider or software supplier fails.
For SMEs, this means the cheapest cyber policy is not necessarily the most useful. A policy may have a credible headline limit but narrowly define dependent business interruption. It may also apply a long waiting period before lost income cover begins. If a retailer makes most of its revenue at weekends, a 24-hour or 48-hour waiting period can leave the most damaging part of the outage uninsured.
Before renewal, ask the broker or insurer for a clear written explanation of what happens if your business cannot trade because a key external service is unavailable following a cyber event. Do not rely on a generic statement that “business interruption is included”.
The supply-chain effect is likely to matter more than direct targeting
A politically linked attack against infrastructure does not need to target an SME to cause loss. The disruption can travel through commercial dependencies. Businesses with thin cash reserves, time-sensitive stock or fixed delivery commitments are particularly exposed.
Map the services that would stop your business
Create a practical dependency list, not a broad risk-register entry. Identify:
- Electricity and premises access: alarms, electronically controlled shutters, card access, heating, refrigeration and charging equipment.
- Connectivity: broadband, mobile networks, hosted telephony and remote-working tools.
- Core technology: email, cloud accounting, customer relationship management, point-of-sale systems and backups.
- Money movement: card terminals, online banking, payroll providers and payment processors.
- Operational suppliers: logistics firms, wholesale distributors, managed IT providers and key manufacturers.
For each dependency, ask two questions: how long can the business operate without it, and what manual workaround genuinely works? A paper order form is not a continuity plan if staff cannot verify stock, take payment or contact customers.
Set a realistic outage tolerance
A concise business impact assessment can be more valuable than an expensive document that nobody reads. Define maximum tolerable downtime for each essential process. For example, an online retailer may tolerate several hours without a marketing platform but not an hour without payment processing; a dental practice may need safe access to appointment records before opening; a small engineering business may need secure control of machinery before production can resume.
Use this assessment to set insurance limits. Estimate the gross profit lost during a three-day, four-day and seven-day outage, then add extra expenses such as emergency generators, temporary premises, specialist IT support, staff overtime and customer communications. The result is a better basis for choosing a business interruption indemnity period and limit than selecting the lowest premium.
Cyber insurance should support response, not replace resilience
Insurance is a financial and incident-response tool. It cannot restore power, rebuild trust instantly or make an uninsured contractual penalty disappear. Insurers also expect reasonable security controls, and a weak control environment may affect underwriting, excesses or coverage depending on the policy wording and the circumstances of a claim.
Controls insurers and businesses should prioritise
The controls below reduce the chance that an external disruption becomes an internal cyber incident:
- Enable multi-factor authentication for email, remote access, cloud administration and financial systems.
- Keep a tested, offline or immutable backup of critical data. A backup that cannot be restored quickly is not a resilience control.
- Separate ordinary user accounts from administrator accounts, and restrict privileged access.
- Patch internet-facing systems promptly and maintain an inventory of devices, software and outsourced services.
- Train staff to report suspicious emails, unusual payment requests and unexpected MFA prompts immediately.
- Maintain an incident response contact list outside company email, including IT support, insurer or broker, legal advisers and key suppliers.
- Test a short scenario: “No power or core cloud systems for four days.” Include decisions on staff communications, customer updates, stock protection and manual trading.
For firms using connected machinery, building-management systems or industrial equipment, IT and OT should not be treated as entirely separate worlds. Segmentation, supplier access controls and a tested safe shutdown process can limit the consequences of a compromise or unstable infrastructure event.
Questions to ask before buying or renewing cyber cover
A useful discussion with a broker should include specific questions rather than broad requests for “comprehensive cover”. Ask:
- Does the policy cover business interruption following a security failure at an outsourced IT, cloud, managed service or payment provider?
- Are power, telecoms or other utility interruptions covered when a cyberattack is the underlying cause?
- Is physical damage required before business interruption cover applies?
- What is the waiting period, how is loss calculated, and does cover include increased cost of working?
- Are state-backed attacks, cyber war, terrorism or widespread infrastructure events excluded? How are these terms defined?
- Does the insurer provide a 24/7 breach-response service, digital forensics, legal advice, notification support and public-relations assistance?
- What security conditions or declarations must the business meet at inception and throughout the policy period?
The answer to the cyber-war question deserves particular care. Cyber insurance has evolved rapidly in response to systemic and geopolitical risk, and exclusions differ by insurer. A business should seek plain-English clarification, especially if it works in an essential supply chain or relies heavily on a single technology provider.
A practical 30-day action plan
In the next month, UK SMEs can take proportionate steps without building an enterprise-sized security department:
Week one: establish ownership
Nominate a director or senior manager responsible for cyber resilience. List critical systems, suppliers and emergency contacts. Confirm who has authority to stop payments, close online ordering or communicate with customers during an incident.
Week two: close common access gaps
Enforce MFA, review administrator accounts, remove ex-staff access and confirm that endpoint protection and software updates are functioning. Check that your managed IT provider has defined incident-response responsibilities.
Week three: test recovery
Restore a sample backup into a safe environment. Time the process. Then test access to essential information without normal email or cloud tools. Record failures and assign owners to fix them.
Week four: review the insurance contract
Read the schedule, endorsements, exclusions and business interruption section with your broker. Compare the policy's waiting period and limit against your four-day outage estimate. Keep the claims notification number in a place accessible during an email outage.
The reported power plant incident is a reminder that cyber resilience is now inseparable from operational resilience. SMEs cannot control geopolitical tension or the security posture of every utility provider. They can, however, understand their dependencies, reduce avoidable vulnerabilities, prepare for several days of disruption and buy insurance that matches the way their business would actually lose money.
FAQ
Would a standard cyber insurance policy cover losses from a UK power outage?
Not necessarily. Cover depends on the wording. Some cyber policies cover only attacks on your own systems, while others extend to qualifying technology suppliers. Utility interruption may sit under a separate property or business interruption policy, often with its own triggers and exclusions. Obtain written confirmation from the insurer or broker.
What is contingent business interruption in cyber insurance?
It is cover for loss of income and, in some policies, extra expense when a cyber event disrupts an external provider your business depends on. The provider may need to be specifically named, or fall within a defined category. Check waiting periods, sub-limits and whether utility providers are included.
Does an Iran-linked attack mean cyber war exclusions will apply?
It may raise the question, but it does not automatically determine the outcome. Attribution standards and policy definitions vary. Insurers may distinguish between politically motivated attacks, terrorism, state-backed operations and cyber war. Seek specialist advice on the precise exclusion language in your policy.
What should an SME do first if a critical service goes offline?
Protect people and equipment, activate the continuity plan, document the time and business impact, contact the affected provider, and notify your insurer or broker as soon as the policy requires. Preserve logs, invoices and evidence of lost sales or additional costs. Do not authorise major recovery work before checking the insurer's claims process unless urgent safety or loss-mitigation action is required.
Source: CyberSecurityNews — Sun, 23 Aug 2026 18:38:22 GMT
