Europe's biggest nuclear facility and the world's largest plutonium storage facility have admitted they are putting Britain's national security at risk after a series of cybersecurity accidents at the huge former nuclear power station in Cumbria, Sellafield.
Sellafield Ltd, which runs the site, apologised after plea of guilty on charges relating to IT security between 2019 and 2023. Westminster Magistrates' Court heard that three-quarters of the nuclear facility's servers were vulnerable to attack during that period.
A The Guardian investigation The nuclear industry also found that contractors were able to gain uncontrolled access to Sellafield computers and were able to connect external drives to Sellafield systems. The company's own report on the issue found that any “sufficiently sophisticated hacker or malicious insider” could have exploited the vulnerabilities.
The court heard from the nuclear regulator that information that could pose a threat national secrecy has been left vulnerable for years because many of the critical security checks that Sellafield Ltd said they were completing were simply not carried out. The site otherwise has a poor reputation, often referred to as “the most dangerous” a UK facility that employs 11,000 people working on nuclear waste treatment and decommissioning equipment.
Tests of vulnerable IT systems have shown that someone could access Sellafield servers and install phishing software “without raising any alarm”, further fuelling concerns about the vulnerability of information in the UK’s key infrastructure to threats from hostile actors.
During their prosecution for failing to secure their systems, it was discovered that 13 files marked “official/confidential” had been mistakenly sent to outside contractors along with 4,000 other files. Somehow, this did not cause any elerts in their computer system, which was partly blamed on the use of “outdated” software, including Windows 7 and Windows 2008.
A statement from Sellafield Ltd chief executive Euan Hutton, who attended but did not speak, was read out at Thursday's hearing.
The statement said: “I again apologise on behalf of the company for the circumstances that led to this litigation… I sincerely believe that the circumstances that led to this prosecution are now in the past.”
The company is not due to be sentenced until September. The Authority for Nuclear Regulation said after a hearing on August 8: “Sellafield Ltd previously pleaded guilty to these offences in June and although the hearing took place today, Chief Magistrate Senior District Judge Paul Goldspring did not pass sentence.
“We expect Sellafield Ltd to be sentenced in September, at which time further details will be available on our website and social media.”