The House Article | Government needs to take cyber security in our energy system seriously

4 min read12 min

One lesson from the conflict in Iran is that a cyber attack is the opening move of modern warfare. Israel proved this, hacking Tehran’s CCTV cameras to mark key targets and the Ayatollah himself for US and Israeli bombing.

But the UK is severely underprepared for this reality. As our energy sector rapidly digitalises like the rest of the world, a new target is opening up for hackers, and unless we learn from the Iran-US war, they will be able to strike at the heart of our industries, government and households.

Our nation is no stranger to having its energy weaponised, causing economic and social pain to British households. From blackouts in the 1970s due to the miners’ strikes and the oil crisis, to energy bills soaring when gas prices spiked following Russia’s invasion of Ukraine in 2022.

Cyber attacks can recreate this economic damage, and no form of energy supply is safe from attack. Whether it is gas, renewables or nuclear, every form of energy that our nation relies upon is susceptible. And as our energy system continues to digitalise, the threat cyber attacks pose to our country is growing.

The UK’s energy system is not prepared for such attacks, and Labour is failing to address this threat to our security.

Our enemies know this all too well. Over 90 per cent of the largest energy firms have already fallen victim to cybersecurity breaches to date, with attacks becoming increasingly regular. And they can repeat the damage other hackers have done to major British companies on our energy system, similar to the attack on Jaguar Land Rover in my constituency of Meriden and Solihull East in 2025 that cost the UK economy an estimated £1.9bn. This also caused major disruption throughout the automotive supply chain and has left companies facing bankruptcy.

Unless we strengthen our security, a cyber attack from anywhere in the world could switch off our energy supply, bringing much of our daily life and our economy to a grinding halt.

Despite this urgent need to take action, the government has ignored the severity of this threat and failed to tackle it since taking office. The Cyber Security and Resilience Bill is a unique opportunity to tackle this glaring oversight. However, Labour ministers are squandering this opportunity to protect our energy supply from cyber attacks.

This is why I am calling on the government to strengthen our energy system against cyber attacks by going further in the Cyber Security and Resilience Bill.

Firstly, the bill should only allow data from the UK energy sector to be processed either within UK territory or that of allied countries with robust cybersecurity mechanisms. By limiting the processing of this data to places we can trust, we would make it harder for cyber criminals to access energy firms’ data and use it for nefarious purposes.

Furthermore, the government should also expand the requirements for energy companies to report when they are victim to cyber attacks. Reporting these attacks to government cybersecurity agencies is essential for deterring further attacks and alerting them to existing holes in our security. Although there are already reporting requirements in the UK, they are not fit for purpose, and the bill does not go far enough to improve them. The current state of the bill means many cyber attacks will continue to go unreported to the relevant cybersecurity agency, reducing our ability to establish where our energy grid is exposed and to respond accordingly.

The risk cyber attacks pose to the UK’s energy security is clear, as is the government’s failure to address this threat. By amending the Cyber Security and Resilience Bill to secure energy firms’ data and ensure more cyber attacks are reported, we can strengthen our cyber security and make it harder for our enemies to turn off our power.

Saqib Bhatti is Conservative MP for Meriden and Solihull East