United Kingdom: the drinking water network targeted by five cyberattacks since early 2024
The media outlet Recorded Future News revealed, on November 3, 2025, the content of a report from the Drinking Water Inspectorate (DWI), the agency responsible for monitoring drinking water in the United Kingdom. According to this document, British water suppliers reported five cybersecurity incidents between January 1, 2024, and October 20, 2025 — an unprecedented number over such a short period. British intelligence services have expressed concern over this “growing threat.”
None of these attacks had any operational impact on water distribution. Since these incidents did not disrupt the functioning of critical infrastructure, UK law did not require them to be reported. However, the suppliers informed the DWI “for information purposes,” as they believed these attacks could have affected “the resilience of the water supply.”
A draft law, the Cyber Security and Resilience Bill, aims to strengthen reporting obligations for cyber incidents affecting critical infrastructure. Repeatedly delayed, its review by the UK Parliament is expected to begin by the end of 2025.