Water companies' increasing use of equipment to monitor household and business water consumption data alongside the increasing deployment of smart meters makes them more vulnerable to cyber-attacks.
This was a warning from credit rating agency Moody’s, which said the risk level was "elevated" amid "growing sophistication of attacks on critical infrastructure" and a "growing class of cyber adversary".
While IT systems used in water treatment facilities were typically separated from customer databases, the rating agency said some systems were becoming more closely integrated.
For a short-lived attack, the expected cost of firming up defences and potential fines would only lead to “modest increase” in debt.
“The greater risk for the sector, and society, is if malicious actors are able to access operational technology systems to impair drinking water or wastewater treatment facilities,” the report said, first published in the Guardian.
Water companies have incorporated greater spending on cybersecurity in their business plans for 2025-2030 filed with regulator Ofwat, which are currently under assessment.
Ofwat’s draft and final determinations are due later this year, with spending already expected to be increased due to greater commitments on leak reductions and sewage treatment to fix the industry's reputation for dumping untreated waste in rivers and coastlines, which Moody's previously has warned is likely to lead to water companies needing to invest three times the sector's current £94 billion existing capital value.