UK Sees Data Infrastructure, Water System Cyberattack Risks

A British government classified assessment of national security risks includes cyberattacks against critical infrastructure amid worries that hacks against data centers, water systems and law enforcement could disrupt public order.

See Also: Essential Elements to Consider when Choosing a Micro-Segmentation Solution

Member of Parliament Darren Jones, chief secretary to the prime minister, disclosed the updates during an unclassified Tuesday session of Parliament, telling lawmakers that a public facing version of the National Security Risk Assessment now lists 95 risks in total.

The national risk assessment, updated annually, “details how the government is identifying, assessing, preparing for and dealing with such potential emergencies,” says a parliamentary report.

“The increasing sophistication and proliferation of artificial intelligence not only brings huge opportunities, but threats too if it is weaponized by criminals against us. This could include novel ways of developing or carrying out hostile cyberattacks against businesses and our critical infrastructure,” Jones said.

The 2026 version of the register adds seven new risks. On the cyber front, the report adds cyberattacks against water infrastructure and police systems, alongside already identified cyber risks facing the health and social care system, gas and electricity infrastructure, fuel supplies, transport and telecommunications sectors.

Another addition is “risk of interference in the U.K.’s democratic process,” said the Cabinet Office, the government’s central ministerial department. That might include “attacks on election infrastructure, deterioration of the online information space, harassment and intimidation towards candidates or voters, the hack and leak of sensitive information relating to a party or a prominent individual, and any element of foreign interference in any of these.”

“Digital resilience failure” is another new addition, “to reflect learning from incidents such as the CrowdStrike IT outage in July 2024” (seeL CrowdStrike Blames ‘Confluence of Factors’ for Global Outage).

Some risks have been removed, such as the potential for disrupted access to Russian gas supplies, on which the U.K. now relies less.

Rising Operational Technology Threats

For water infrastructure, the report warns that as the sector has become more exposed to cyberattacks, as reflected by the successful compromise of operational technology systems in Poland’s energy sector in December 2025, and a destructive attack against the Tureby Alkestrup Waterworks in Denmark in 2024.

“The reasonable worst‑case scenario assumes an advanced cyber actor infiltrates the OT systems of a water company” and deploys destructive malware that “results in the water company losing visibility and control of its systems,” causing disruptions that could take “several months” to rectify, the register says (see: When Hackers Cut the Internet, Will the Water Still Flow?).

“Unlike physical repairs, recovery involves complex digital challenges: many OT components are specific to the facility and may require full replacement or reconfiguration. Furthermore, the water company would need assurance that the attacker has been completely removed from the network, requiring rigorous isolation and testing of all systems before services can be safely restored,” the risk register states.

The Cabinet Office also announced that as part of the Home Defense Program, the government in 2027 will run “the largest U.K. home defense exercise in decades.” Government ministers and hundreds of officials will take part in the operation, which is designed in part to test the government’s revised “war books,” which are classified government crisis-response plans last updated in 2004.

Dubbed Operation Albiston Shadow, the details of the multi-day scenario remain classified, but “will test government preparedness for hybrid attacks against the U.K.,” and is designed to complement NATO’s forthcoming CMX27 exercise. “Both drills will help to ensure U.K. alignment with NATO allies and partners against a backdrop of rising threats,” it said.

“We increase the chances of conflict by not being ready – fail to prepare, prepare to fail,” said MP Louise Sandher-Jones, the government’s minister for the armed forces.