LONDON, July 25 — The Cold River hacking campaign that carved a path through global fusion energy research landed squarely on the UK Atomic Energy Authority, a public body established by the Atomic Energy Authority Act 1954. The mechanics here are worth unpacking: this was not a scatter-shot affair. The attackers systematically harvested email credentials from scientists who held keys to strategic fusion databases, conference presentations, and funding proposals.
On closer reading of the UK’s National Cyber Security Centre advisory (NCSC-OAR-2023-001), published in March 2023, the list of targeted institutions reads like a who’s who of fusion research—and the UKAEA sits at the centre of it. The UKAEA operates the Joint European Torus at the Culham Science Centre in Oxfordshire, the world’s largest operational tokamak, a primary fusion research site since 1983.
It also runs the MAST upgrade—the Mega Amp Spherical Tokamak—and the forthcoming STEP programme, short for Spherical Tokamak for Energy Production. STEP aims to deliver a prototype fusion power plant by 2040. That is a clear, stated goal.
The catch is that the very databases and proposals that underpin that timeline were among the assets the hackers chased.
Across the Atlantic, same pattern
The campaign was not confined to the UK. In the United States, hackers went after national laboratories under the Department of Energy’s Office of Science. The targets included the Princeton Plasma Physics Laboratory in New Jersey, the Oak Ridge National Laboratory in Tennessee—home to the Spallation Neutron Source and fusion materials research—and the DIII-D National Fusion Facility at General Atomics in San Diego.
NATO fusion research is coordinated through the NATO Science and Technology Organization. The hacking reached member states: Germany’s Max Planck Institute for Plasma Physics at Garching, France’s CEA at Cadarache—the site for ITER—and Italy’s ENEA at Frascati.
Private fusion companies were also monitored for compromise, including Commonwealth Fusion Systems in Massachusetts and TAE Technologies in California.
The advisory trail
The US Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response—CESER—issued an alert on 30 March 2023. The directive was blunt: all fusion research entities should adopt multi-factor authentication and review privileged access. The alert did not name Cold River explicitly in the source material, but the timing and the institutional overlap with the NCSC advisory are hard to ignore.
The NCSC had already published its own list of compromised and monitored organisations. The targeting was systematic.
That is a fact. The hackers did not simply breach perimeter firewalls; they went after the people who hold the credentials to the most sensitive fusion databases. They scraped conference presentations and funding proposals, two rich seams of intellectual property that reveal not just current science but future strategy.
For a programme like STEP, which aims to move from research to a working prototype by 2040, the loss of that kind of forward-looking data is not just a security headache—it is a competitive liability. What to watch next: the degree to which these alerts actually changed institutional behaviour.
Multi-factor authentication and privileged access reviews are basic, but the fusion research world has long operated as a relatively open, collaborative international community. The catch is that openness and security do not sit easily together. If the Cold River campaign proves anything, it is that the mechanics of academic and governmental research networks are as attractive to state-backed hackers as any defence contractor’s server room—and often less well defended.
Sources
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “US, UK, NATO labs and firms targeted in cyberattacks”, “description”: “LONDON, July 25 — The Cold River hacking campaign that carved a path through global fusion energy research landed squarely on the UK Atomic Energy…”, “datePublished”: “2026-07-25T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Beatrice Ferrari”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “citation”: [{“@type”: “CreativeWork”, “url”: “https://en.wikipedia.org/wiki/UK_Atomic_Energy_Authority”}]}
