Thames Water’s Aging IT Infrastructure Exposes Critical Cybersecurity Risks Thames Water, the UK’s largest water and waste treatment provider, is grappling with severe vulnerabilities in its IT infrastructure, leaving it exposed to cyber threats. Serving 16 million customers across London and the Thames Valley, the company relies on outdated systems some dating back to the 1980s including obsolete Lotus Notes software and 30-year-old hardware. Employees describe a fragile network held together by makeshift repairs, with some machines unable to be powered down for fear they won’t restart. The risks are acute. Sources reveal that state-linked cyber groups from Russia, China, Iran, and North Korea have targeted Thames Water, with some attacks partially succeeding in disrupting operations. The National Cyber Security Centre (NCSC), part of GCHQ, has warned of heightened threats to the UK’s water sector, particularly from actors sympathetic to Russia’s invasion of Ukraine. Despite these warnings, Thames Water has denied experiencing any cyberattacks, though insiders report an inability to conduct essential security protocols like "dark testing" due to system instability. Physical security gaps compound the digital risks. Contractors without clearance have reportedly accessed areas housing sensitive IT equipment, raising concerns about unauthorized hardware tampering. While Thames Water insists all sites have "stringent security measures," the Drinking Water Inspectorate (DWI) has already issued an enforcement notice over physical security lapses at one facility this year. Regulators are under pressure to address the issue. Ofwat, the economic regulator, is reviewing Thames Water’s £20.7 billion investment plan for 2025–2030, which includes funding for asset upgrades. The DWI, responsible for drinking water safety, has emphasized its role in investigating risks to water supply but operates with limited staff. Meanwhile, Thames Water acknowledges an "asset deficit" but maintains that its water quality remains among the world’s highest. The situation underscores broader concerns about underinvestment in critical national infrastructure, where aging systems and cyber threats intersect, leaving essential services vulnerable to disruption.