Author: Eternity Lab

Cumbrian nuclear facility Sellafield is still under scrutiny for cyber security problems, despite the regulator’s clean bill of health for its physical security.

The Office for Nuclear Regulation (ONR) has returned the Sellafield site to a “routine regulatory regime for physical security after a period of enhanced oversight”, according to a government statement.

The ONR’s statement said: “Over the last two years, ONR has carried out a regular programme of inspections and interventions at Sellafield, assessing evidence provided by the licensee’s security and resilience team. This identified a period of sustained improved performance in the area of physical security, and ONR is satisfied that the required security outcomes are now being achieved.”

However, the ONR added: “Sellafield Ltd currently remains in significantly enhanced attention for cyber security, and collaborative work is ongoing to achieve the required improvements in this area.”

In December 2023, The Guardian reported that groups linked to China and Russia had hacked into Sellafield’s IT systems, “embedding sleeper malware that could lurk and be used to spy or attack systems”.

And in October 2024, the nuclear waste facility was ordered to pay £400,000 by Westminster Magistrates’ Court, after it pleaded guilty to criminal charges over years of cyber security failings, and apologised to the court.

The ONR brought the charges against Sellafield Ltd, accusing it of leaving exposed information that could threaten national security over a four-year period, from 2019 to 2023. Three-quarters of its servers were also said to be vulnerable to cyber attack.

One of the three criminal charges brought related to Sellafield’s failure to “ensure that there was adequate protection of sensitive nuclear information on its information technology network”, while the other two related to failures to conduct “annual health checks” of its IT systems.

Sellafield’s lawyers said at the time, “it is important to emphasise there was not and has never been a successful cyber attack on [the facility]”, before noting that the offences are “historical … [and] do not reflect the current position”.

Paul Dicks, the ONR’s director of regulation for Sellafield, decommissioning, fuel and waste, said of the new bill of health: “We have worked closely with Sellafield Ltd through our enabling approach to ensure that the required improvements are delivered. I’m satisfied that Sellafield Ltd has demonstrated significant and sustained security improvements which has allowed us to return them to routine regulatory attention.”

Sellafield operates under the governance of the Nuclear Decommissioning Authority (NDA), a quasi-governmental body that serves to wind up and render safe the UK’s oldest nuclear industry sites.

In November 2024, the NDA opened a cyber security centre to safeguard against cyber attacks on the civil nuclear sector. 

Its Group Cyberspace Collaboration Centre in Cumbria is said to gather security, digital and engineering experts to work on how best to adopt new technologies and defend against evolving threats.

Warren Cain, superintending inspector at the Office for Nuclear Regulation, said: “All nuclear sites must have strong cyber security systems in place to protect important information and assets from cyber threats.

“Cyber security is a key regulatory priority for the Office for Nuclear Regulation, and we welcome the NDA’s commitment to strengthen their cyber defences with this new specialist facility.”

Besides Sellafield, the UK’s nuclear sites include Hinkley Point, Harwell, Dungeness, Bradwell and Sizewell, Trawsfynydd and Wylfa, and Dounreay.

Source

MPs and peers have launched an inquiry into the UK’s ability to protect undersea internet cables that link the country with the rest of the world, following heightened threats of sabotage from Russia, China and other hostile states.

The Joint Committee on the National Security Strategy, which scrutinises government decision-making on national security, aims to assess the UK’s readiness for potential attacks on critical underseas communication cables.

The inquiry follows a statement by the defence secretary John Healey in the Commons this week, warning that Russian president Vladimir Putin is targeting the UK’s undersea oil, gas, electricity and internet cables after a Russian spy ship entered British waters.

Healey said the research vessel, Yantar, was engaged in “gathering intelligence and mapping the UK’s critical underwater infrastructure”, following its discovery in UK waters on 20 January 2025. He told Putin: “We see you, we know what you are doing, and we will not shy away from robust action to protect this country.”

According to the parliamentary committee’s chairman, Matt Western, 99% of the country’s data passes through underseas internet cables, making them a soft target for action by foreign states seeking to covertly damage the UK.

“As the geopolitical environment worsens, foreign states are seeking asymmetric ways to hold us at risk,” he said. “Our internet cable network looks like an increasingly vulnerable soft underbelly. There is no need for panic – we have a good degree of resilience, and awareness of the challenge is growing. But we must be clear-eyed about the risks and consequences: an attack of this nature would hit us hard.”

The global internet, which is critical for international communications and commerce, relies on a network of 500 cables that carry 95% of internet traffic. The cables are often in remote places, making them difficult and expensive to monitor.

Attack could disrupt essential services

The UK relies on about 60 cables to connect it with the rest of the world that provide resilience if one or two are deliberately or accidentally damaged. However, MPs and peers have raised concerns that a simultaneous attack on multiple cables, particularly during times of heightened tension or conflict, could cause significant disruption.

According to the UK’s 2025 National Risk Register, in a reasonable worst-case scenario, the loss of transatlantic subsea cables linking to the UK would cause “considerable disruption” to essential services, including financial services, that rely on offshore datacentres and offshore service providers. 

There have been a number of incidents in Northern European waters where cables have been severed, including links between Norway, Sweden, Finland and the Shetland Islands. Over 50 Russian vessels have been observed near areas of high cable density in the Baltic Sea, leading European countries to reassess the security of their underseas infrastructure.

Most recently, on 25 December 2024, Russian-linked oil tanker Eagle S dragged its anchor for 60 miles in the Baltic, damaging the Estlink-2 power cable connecting Finland and Estonia and four data cables. The tanker has been impounded by Finland.

The UK, along with other military partners, announced the launch of Operation Nordic Warden in January 2025 to track potential threats to underseas infrastructure and to monitor the activities of Russia’s shadow shipping fleet.

The operation will use artificial intelligence to analyse data from a range of sources, including the Automatic Identification System, used by ships to broadcast their position, to assess the risks posed by vessels in areas close to undersea cables.

The inquiry aims to assess the UK’s ability to defend subsea infrastructure, options for improving deterrence, work with military allies and the UK’s resilience in the event of major disruption to internet infrastructure. The committee has set a deadline of 6 March for evidence.

Source