The state-owned operator of the UK’s Sellafield nuclear waste site has apologised after pleading guilty to criminal charges relating to a string of cybersecurity failings at the UK’s most hazardous nuclear site, which it admitted could have threatened national security.

Among the failings at the site in Cumbria, northwest England, was the discovery that 75% of its computer servers were vulnerable to cyber-attacks, Westminster magistrates court in London heard.

Information that could threaten national security was left exposed for four years, the Office for Nuclear Regulation (ONR) revealed, and Sellafield said it had been performing critical IT health checks that were not, in fact, being carried out.

In a written witness statement referred to in court on 8 August Euan Hutton, chief executive of Sellafield, apologised for failures spanning years.