Sellafield pleads responsible to felony fees over cybersecurity failings

The UK’s most hazardous nuclear website, Sellafield, has pleaded responsible to felony fees associated to cybersecurity failings introduced by the trade regulator.

Attorneys performing for Sellafield advised Westminster magistrates’ court docket on Thursday that cybersecurity necessities had been “not sufficiently adhered to for a interval” on the huge nuclear waste dump in Cumbria.

The costs relate to info know-how safety offences spanning a four-year interval from 2019 to 2023. It emerged in March that the Workplace for Nuclear Regulation (ONR) supposed to prosecute Sellafield for know-how safety offences.

Late final yr the Guardian’s Nuclear Leaks investigation revealed a list of IT failings on the website courting again a number of years.

Sellafield pleaded responsible to a cost that it had didn’t “make sure that there was enough safety of delicate nuclear info on its info know-how community”, the Monetary Occasions reported.

The Guardian reported final yr that the positioning programs had been hacked by groups linked to Russia and China in December final yr, embedding sleeper malware that would lurk and be used to spy or assault programs. On the time, Sellafield mentioned it didn’t have proof of a profitable cyber-attack.

Paul Greaney KC, performing for Sellafield, advised the court docket: “You will need to emphasise there was not and has by no means been a profitable cyber-attack on Sellafield.”

Greaney added that Sellafield’s programs had been now strong and mentioned media experiences of hacks had been “false”.

An ONR spokesperson mentioned: “We acknowledge that Sellafield Restricted has pleaded responsible to all fees.

“There is no such thing as a proof that any vulnerabilities have been exploited,” the spokesperson mentioned, including that as a result of ongoing authorized proceedings the ONR couldn’t supply additional element right now.

Sentencing is anticipated to happen on 8 August.

The positioning has the most important retailer of plutonium on this planet and is a sprawling garbage dump for nuclear waste from weapons programmes and a long time of atomic energy era.

The Guardian investigation revealed a string of IT points, together with considerations about exterior contractors with the ability to plug reminiscence sticks into its pc system whereas unsupervised.

The investigation discovered issues had been recognized by senior figures on the nuclear website for at the least a decade, in response to a report dated from 2012, which warned there have been “vital safety vulnerabilities” that wanted to be addressed urgently.

Sellafield’s pc servers had been deemed so insecure that the issue was nicknamed Voldemort after the Harry Potter villain, in response to a authorities official aware of the ONR investigation and IT failings on the website, as a result of it was so delicate and harmful.

On the time, Sellafield mentioned that “all of our programs and servers have a number of layers of safety”.

“Important networks that allow us to function safely are remoted from our basic IT community, which means an assault on our IT system wouldn’t penetrate these,” a spokesperson mentioned.

Britain’s public spending watchdog, the Nationwide Audit Workplace, launched an investigation into dangers and prices at Sellafield earlier this yr.

A spokesperson for Sellafield mentioned: “We’ve pleaded responsible to all fees and cooperated absolutely with ONR all through this course of. The costs relate to historic offences and there’s no suggestion that public security was compromised.

“As the difficulty stays the topic of lively court docket proceedings, we’re unable to remark additional.”