Last week, in the final days of the Starmer administration, the government handed Andy Burnham one of the strongest possible arguments for nationalising the water industry. In a move that went almost unnoticed, it updated the National Risk Register (NRR) – the public-facing version of a classified document it uses to inform contingency planning for the emergency services.
For most of the risks identified there was incremental change. But one difference between the 2025 and 2026 assessments was massive. Last year the government estimated the risk of a single region losing its water supply to be minor, and the likelihood between 0.2% and 1%. Nothing to see here.
This year the risk matrix is flashing red. There is now a 5-25% chance of a region losing its water supply, and the impact is judged “catastrophic”.
Schools, prisons and hospitals would need to close. No amount of bottled water or water trucks could fill the gap in supply, and “residents would likely have to leave the area, and some may require evacuation. It is likely that repair of the infrastructure could take months”.
Why the change? Because for the first time ever the government is now modelling the possibility of a cyber-attack that takes out water and sewage equipment, or the electricity that supplies them. The water industry as a whole consumes 3% of UK electricity and is therefore vulnerable both to direct cyber-attack and any attack on the energy grid.
Here’s the stark picture the assessment paints of the results of such an attack:
“A return to full functionality could take several months. Unlike physical repairs, recovery involves complex digital challenges: many [operational technology] components are specific to the facility and may require full replacement or reconfiguration.”
The report does not give an estimate of how likely such a specific attack might be, but groups all potential cyber-attacks on infrastructure as, again, up to a one-in-four chance, but with “moderate” impact.
Water has become vulnerable because the system is increasingly digitally controlled. And if an enemy can shut down the British Library’s systems so badly that you still cannot deposit an e-book there, two years later, and shut down Jaguar Land Rover’s production line to the tune of £1.5bn in losses, you have to take the threat against the water system as real.
The change of mindset is welcome, but should be of huge concern; because the level of investment required to harden our water systems against cyber-meddling and give them fallback electrical systems should the grid come under attack is very probably beyond the ability of the privatised water sector.
Suggested Reading
The science is clear – the world is heading for water catastrophe
The privately owned utilities are sitting on £72bn of debt and have paid out £85bn in dividends to their shareholders since they were privatised. Thames Water, which is struggling to avoid administration, is trying to persuade the government to let it off future fines in order to incentivise investing in the capital’s crumbling pipes and treatment works.
Section 37 of the Water Industry Act 1991 requires water companies to maintain a continuous water supply to households. Section 208 gives the government the right to give water companies orders “in the interests of national security or for the purpose of mitigating the effects of any civil emergency which may occur”.
But it is clear, from the National Risk Register, that the government does not believe the companies can react effectively – not because of any structural problems arising from privatisation, but due to the wider technical challenge posed by digitisation, plus the rising threat.
As the NRR makes clear, both Poland and Denmark have had their digital water-control systems compromised in the past two years. And while the overall risk assessment says it is “highly unlikely” that such an attack could succeed here, the quantification of “catastrophic” is sobering.
For the government’s risk assessment, catastrophic means more than 1,000 people dead, more than 2,000 casualties and economic costs running to tens of billions of pounds.
But there are solutions. You could mutualise the water companies. You could take a government stake in the ones that cannot afford to invest to make their digital systems more secure. You could install solar panels and battery storage next to every vulnerable node on the network, so that energy costs – and therefore bills – might fall.
But in the end you are going to need what Andy Burnham has argued for: greater ownership and control over the water industry, in order to stop the rent-seeking, reduce the costs and secure the continuity of supply.
Water, in addition, is becoming a battleground in the class struggle. Artificial intelligence demands datacentres, and datacentres demand water. In addition, the electricity they consume places extra burdens on the water system, which has to compete with the datacentre industry for use of the available electricity.
Suggested Reading
How to save science from populism
I support, and am inspired by, the rollout of AI capabilities – especially if they can be sovereign intellectual property, based in Britain. So I want there to be more supercomputers and datacentres here.
But more than half the datacentres in the UK planning process are in London and the south-east – the precise area with the most useless privatised water company, and where you’re competing directly with people, other industries and agriculture for the water supply.
Under a “high growth” scenario outlined by Thames Water, over 30% of new water demand comes from AI datacentres. So even as we solve the old problems – of Victorian drains and neoliberal asset stripping – the new ones demand greater ownership and control.
Who gets what water is going to be a major issue, which only the democratic state can arbitrate. Who invests what to keep the supply safe is – again – only solvable through state intervention.
So something has to give. If Andy Burnham is serious about ending “40 years of neoliberalism” he could do well to take on and solve this problem. We could have probably sorted the semi-bankruptcy and inefficiency of the water companies through compromise, placing some into administration, encouraging others down a path to mutualisation, over maybe a decade.
But one glance at the National Risk Register, and the massive change embodied in the new assessment of water risk, shows we don’t have time for that. Because it’s one thing to be told to live on the baked beans and pasta in your cupboard for a few days. It’s another thing altogether to turn the taps on and see nothing come out.
Under Section 208 of the Water Industry Act the government has the right to say to every water company in England: mitigate this massive and newly recognised risk through investment. If they cannot, it should have no hesitation in legislating them back into public hands.
