Ancient UK water systems face a modern security threat that's worrying business leaders
A perfect storm of decaying physical infrastructure and vulnerable operational technology is putting supply resilience at risk.
Britain's physical water infrastructure is getting very old and now leaks almost three billion litres of water a day.
Unfortunately, the same can also be said about the operational technology which keeps water running to tens of millions of people around the country.
Many of the critical systems that control Britain's water networks are decades old, built when industrial machinery operated in isolation and cybersecurity was barely a consideration.
Now they are increasingly likely to be connected to the internet, creating security risks that critical infrastructure systems were simply not designed to deal with.
The result is an expanding attack surface that gives everyone from cybercriminals to nation-state actors the opportunity to do genuine damage to the systems modern society is completely dependent upon.
New research from the energy technology company Schneider Electric found that 75% of UK water system decision-makers identified external cyberattacks against connected infrastructure as a major threat to resilience.
Six in ten industrial business leaders also ranked cyber threats among their three biggest business continuity risks.
Schneider Electric published the findings in its Water Crunch Report, which examined the pressures facing water infrastructure across Britain and Europe.
Ageing infrastructure emerged as the biggest obstacle to protecting British businesses from water-related disruption, cited by 57% of UK industrial leaders compared with 36% across Europe.
Threat actors target connected infrastructure
The threat to connected industrial systems has already attracted the attention of Britain's cybersecurity authorities.
In August 2026, the National Cyber Security Centre (NCSC) published new guidance on protecting connected water infrastructure.
The NCSC is not the first to warn about growing security risks facing operational technology (OT), including the industrial control systems used to operate pumps, treatment equipment and distribution networks.
Industrial equipment can be particularly difficult to protect because much of it was never designed to meet modern cybersecurity requirements.
Once upon a time, these systems operated in safely sequestered industrial environments, built with safety and reliability taking priority over protection against remote attackers.
The search for convenience has bridged air gaps and connected these once-isolated systems to the internet so operators can control them remotely.
As you might expect, many of these systems lack modern security protections. Equipment that cannot be easily taken offline for maintenance is also more difficult to update.
For water utilities, a successful intrusion has a huge blast radius that extends well beyond information theft.
Attackers who access operational technology may be able to interfere with physical processes - as happened when hackers seized control of French supermarket fridges and turned the temperature up so high that fires broke out.
It's easy to imagine threat actors poisoning the water, wrecking pumping stations, and taking all sorts of actions that could disrupt or even contaminate vital supplies.
Connection and fragility
Schneider Electric's research suggests British industrial businesses are already adopting connected water technologies at scale.
Some 70% of UK industrial leaders surveyed reported implementing smart meters and real-time water consumption monitoring, allowing organisations to identify excessive usage and detect potential problems.
Nearly three-quarters (73%) said their organisations had introduced automated controls for pumps, valves or water treatment systems.
Meanwhile, 63% reported using integrated water management platforms, including supervisory control and data acquisition (SCADA) technology.
This additional connectivity creates potential routes right in the heart of critical infrastructure.
Yet despite the growing use of smart water technologies, Schneider Electric found that more sophisticated modelling systems remain relatively uncommon.
Just 25% of UK water system decision-makers surveyed said their organisations had deployed digital twins or network-modelling technology.
READ MORE: "Iranian hackers" shut down a UK power station. The next incident could be much worse
Digital twins let operators create virtual representations of physical infrastructure, helping them simulate network behaviour, spot potential problems and test changes before implementing them.
"Water resilience depends on more than recognising the risk," said Alex Richards, Vice President for Industrial Process & Automation at Schneider Electric.
"It requires investment in infrastructure, better visibility of water networks and strong cybersecurity as those networks become more connected."
Richards said the research highlighted the difficulties organisations face in improving the reliability of ageing infrastructure.
"The UK findings point to a clear tension: many organisations are adopting smart water technologies, yet ageing infrastructure remains a major barrier, and digital-twin deployment among water decision-makers is still limited.
"Improving resilience means combining modernisation with clearer standards and robust protection of connected systems."
Water shortages threaten future business growth
The research also found widespread concern about future water availability.
One in three (33%) UK industrial business leaders surveyed expected water quality or availability to become a serious obstacle to operations or growth within the next five years.
A further 37% expected water-related problems to become a significant barrier within six to ten years.
These concerns follow severe drought conditions across parts of Britain and Europe, raising questions about whether existing infrastructure can meet demand as populations grow and climate conditions change.
The scale of the challenge is illustrated by Britain's continuing struggle with leakage.
Ofwat's latest figures show that water companies in England and Wales lost approximately 2,869 million litres of water per day in 2024–25.
Meanwhile, Schneider Electric warned that drought and pressure on water supplies should no longer be regarded as isolated problems.
"It's easy to write off this summer's droughts and impact on industry as a one-off, but this is now a structural feature of operating in the UK and Europe," said Sophie Borgne, Water & Environment Segment President at Schneider Electric.
Borgne argued that recycling water could ease pressure on supplies, citing estimates that less than 1% of treated urban wastewater is currently reused in the UK.
"Reusing water can reduce our dependence on rivers and reservoirs already under strain, yet less than 1% of treated urban wastewater is reused across the UK today.
"The organisations investing in smart water technology are turning water efficiency into a competitive advantage."
READ MORE: “Psychological warfare”: ASOS hackers use push notifications to deliver fear to the front door
Regulatory uncertainty was another concern the research identified.
Four in ten (40%) UK water system decision-makers said clearer regulatory standards would most improve their ability to protect operations from water disruption.
Ageing physical infrastructure, growing pressure on water supplies, and the cybersecurity challenges of connected industrial systems present water operators with several problems to solve at once.
Modern technology may help utilities detect leaks, reduce waste and improve the reliability of essential services.
But protecting the digital systems increasingly responsible for managing that infrastructure is becoming another essential part of keeping the water flowing.
