In a shocking revelation, it has been alleged that Sellafield, the United Kingdom’s most perilous nuclear facility located in Cumbria, has fallen victim to cyberattacks orchestrated by groups linked to Russia and China. The clandestine breach, which reportedly occurred several years ago, has been kept under wraps by senior officials, raising serious concerns about the security of the country’s most hazardous site.

The Guardian, after a year-long investigation into cyber hacking, has uncovered that Sellafield’s IT systems were compromised, with sleeper malware embedded in its computer networks as early as 2015. The exact timeline of the breach remains uncertain, leaving authorities grappling with the implications for the leakage of sensitive and critical information.

The affected software, designed for system attacks, may still be present within the nuclear plant’s networks, posing a potential threat to its operations. Sellafield’s crucial activities, such as the transportation of radioactive waste, monitoring for hazardous material leaks, and fire prevention, are now under heightened scrutiny.

The extent of data loss remains elusive, partly due to the facility’s failure to promptly inform nuclear regulators about the breach. The delay in reporting has further complicated efforts to assess the potential damage caused by the cyber intrusion.

Sellafield, a sprawling multi-function nuclear site on the UK coast, plays a pivotal role in processing nuclear waste generated over decades of atomic power and weapons programs. It also houses the world’s largest store of plutonium. The plant, now primarily dedicated to waste processing, was placed under “special measures” last year by the Office for Nuclear Regulation (ONR) and security services due to persistent cybersecurity failures.

The toxic workplace culture at Sellafield was also a focus of The Guardian’s investigation. The plant, monitored by armed guards, has faced criticism for its cybersecurity lapses and failure to meet industry standards.

While three individuals are reportedly facing prosecution by the ONR for their roles in the cyber failings, the regulatory body has refrained from commenting on specific breaches. However, it confirmed that Sellafield failed to meet essential cyber standards, exacerbating concerns about the vulnerability of critical infrastructure to state-sponsored cyber threats.

This revelation underscores the growing need for enhanced cybersecurity measures in facilities handling hazardous materials and critical infrastructure, as nation-states increasingly target such sites for geopolitical leverage. The fallout from this breach at Sellafield raises questions about the overall resilience of critical infrastructure against sophisticated cyber threats and the urgency for comprehensive cybersecurity reforms.