Sellafield 'sorry' as it admits guilt for failures

Sellafield has apologised after pleading guilty to criminal charges over cybersecurity failings at the UK's most hazardous nuclear site, admitting they could have threatened national security.

- Anna Isaac , Alex Lawson

Among the failings at the nuclear waste dump in Cumbria was the discovery that 75% of computer servers were vulnerable to cyber-attacks, Westminster magistrates court heard.

Information that could threaten UK national security was left exposed for four years, the nuclear watchdog revealed, while Sellafield also said it had performed critical IT health checks that had not in fact been done.

Late last year the Guardian's Nuclear Leaks investigation revealed a string of IT failings at the state-owned company dating back several years, as well as radioactive contamination and a toxic workplace culture. Sellafield is a dump for nuclear waste from weapons programmes and decades of atomic power generation. It is part of the Nuclear Decommissioning Authority, a quango owned and funded by the taxpayer.

The Guardian investigation also revealed concerns about external contractors being able to plug memory sticks into its system while unsupervised and that Sellafield's servers were deemed so insecure that the problem with them was nicknamed Voldemort, after the Harry Potter villain, because it was so sensitive and dangerous.

Sellafield pleaded guilty to charges brought by the Office for Nuclear Regulation (ONR) in June, which relate to information technology security offences spanning a four-year period from 2019 to 2023. Sellafield is now awaiting final sentencing, which the chief magistrate, Paul Goldspring, said would take place within weeks.