A series of revelations about Sellafield, often considered Europe’s most hazardous nuclear site, has exposed how ongoing leaks of radioactive waste and infiltration of the site’s online systems by foreign cyber groups have been covered up by officials for years.

A year-long investigation by the Guardian, titled ‘Nuclear Leaks’, has found that the Sellafield site, located on the Cumbrian coast in the UK, has been hacked on numerous occasions by groups with close ties to Russia and China. The impacts of the cyberattacks, the first of which was detected as far back as 2015, have been “consistently covered up by senior staff”. A report published in 2012 also warned that there were “critical security vulnerabilities” at the site.

"Sleeper malware", which describes software that lurks in the background of computer systems and is often used to spy on or attack systems, has been embedded in Sellafield’s online networks for almost a decade.

It is not known now whether the malware has been removed, the Guardian said, but the presence of it for so long could mean that information and data on the site’s most sensitive activities has been fed back to foreign parties. Sellafield is used primarily as a nuclear waste and decommissioning site. It moves radioactive waste from storage ponds and silos, holds spent nuclear fuel from power stations in the UK and provides storage for “special nuclear materials”.

Sellafield has the world's largest stores of plutonium, a highly reactive metal used to make nuclear weapons, a legacy of its use as a site to manufacture nuclear weapons during the Cold War. On top of its role as a massive dumping ground for highly toxic nuclear waste, the site also holds emergency planning documents setting out nuclear protocols and steps the government should take should the UK come under foreign attack.

Sources have said that it is “likely” foreign hackers have accessed the “highest echelons of confidential material at the site,” although estimations about the full extent of lost data and ongoing risks have been complicated by the failure of site officials to notify regulators for several years.

The investigation also found that last year, Sellafield was placed on “special measures” for repeated cybersecurity failings. Watchdog, the Office for Nuclear Regulation (ONR), is preparing to prosecute individuals for failings related to cybersecurity. A government official familiar with the ONR investigation said that the site’s networks were “fundamentally insecure” and the potential data leaks could be exploited by the UK’s enemies.

Sellafield said in a statement published in response to the investigation: “We take cybersecurity extremely seriously at Sellafield. All of our systems and servers have multiple layers of protection… Critical networks that enable us to operate safely are isolated from our general IT network, meaning an attack on our IT system would not penetrate these.

“We have no records or evidence to suggest that Sellafield Ltd networks have been successfully attacked by state-actors in the way described by the Guardian. Our monitoring systems are robust and we have a high degree of confidence that no such malware exists on our system.”

Worsening radioactive waste leak poses threat to public

The investigation also revealed that a worsening leak from one of Sellafield’s huge silos, which holds vast quantities of nuclear waste, could pose a risk to the public.

Concerns over risks relating to a decaying building as well as cracks in a reservoir full of toxic sludge, known as B30, have caused diplomatic problems with several foreign governments including the US, Norway and Ireland.

The leak coming from the crumbling building, known as the Magnox swarf storage silo, is likely to continue until 2050, when the waste will be fully rehoused. Should the leak worsen, contamination of surrounding groundwater could have “potentially significant consequences” on public health, according to an official document sent to members of the Sellafield board in November last year.

International concerns over the state of the site have been prominent for decades. In 2001, a report from the EU warned that a major accident at Sellafield could create a disaster worse than Chernobyl, principally because it contains significantly more radioactive material than the Ukrainian nuclear plant did at the time of its 1986 disaster. A fire at the site, previously known as Windscale, in 1957, still stands as the UK’s worst nuclear accident.

Diplomatic cables from the US have also raised concerns over Sellafield’s decaying infrastructure. One of the country’s biggest worries is a lack of transparency from the UK Government on the extent of the situation at the site. In 2006, the Irish Government tried to take legal action against Sellafield over its negative environmental impacts.

Scientists are becoming increasingly worried about the extent of radioactive contamination coming from the site. A committee of scientists, known as the Committee on Medical Aspects of Radiation in the Environment, noted in minutes released to the public that “the leak has been continuing at the same rate since October 2020, around 2.5m [cubic meters] per day…” but the exact extent of nuclear waste entering the ground was redacted from the documents.

One scientist on the committee said: “It’s hard to know if transparency is put aside because no one’s brave enough to say ‘we simply don’t know how dangerous this is – other than certainly dangerous.

“That’s incredibly serious in the context of a site full of horrors and the legacy of experiments no one properly documented.”

Serious concerns over the decaying nature of the B30 building have also been voiced by Sellafield workers, who say that cracks have significantly worsened in recent months. Risk reports seen by sources show that the site now has more than 100 safety problems that should be a matter of “serious regulatory concern”, ranging from radioactive leaks, to fire safety problems, to lack of proper training for employees.

Revelations of the severity of the situation at Sellafield come at a time of increased domestic and international interest in nuclear power as a source of low-carbon energy. The UK has this year committed millions of pounds to the development of nuclear energy in the country. Chancellor Jeremy Hunt also announced the launch of the Great British Nuclear programme in his Spring Budget in March as the country aims to generate 25% of its electricity from nuclear sources by 2050.

Elsewhere, 20 countries just signed an agreement at the UN climate summit, COP28, to triple nuclear energy capacity by 2050 from 2020 levels. Soon after the pledge was announced, French President Emmanuel Macron said that “nuclear energy is back”, adding the agreement “sends a powerful message to the world”.