Thames Water has £23bn of assets that are in urgent need of repair and the supply of water to its 16 million customers is “on a knife-edge”, a Guardian investigation can reveal.

Britain’s biggest water company has failed to tackle adequately serious safety concerns, has not upgraded essential IT systems and has tolerated a culture of intimidation among staff, according to insiders and an analysis of documents.

The investigation suggests that the company is in a worse financial state than previously admitted, and neither its managers nor regulators appear to have grasped the perilous state of some of its reservoirs and pipes.

The Guardian has also discovered that key data is still managed on obsolete software that dates to 1989. Sources claim that the company has been subject to cyber-attacks from groups affiliated with hostile states, including Russia.

A spokesperson for Thames Water said: “The wellbeing and safety of our colleagues and customers is our highest priority.” Regarding cyber-attacks, Thames declined to comment on the record, but a source at the company said it had “not experienced any cyber-attacks, full stop”.

The Guardian has spent several months investigating the finances and culture of Thames Water.

Sources described how concerns about the company’s governance and operations had been raised at the highest levels of management. Yet they claimed that the problems had not been tackled, suggesting that the scale of the turnaround required at Thames may have been underestimated.

“Operations have been hollowed out and cut to the bone,” a senior source at Thames said. “We’re putting the public at risk by failing to invest in the most basic needs.”

They added that, in their view, management had not moved quickly enough to address problems such as weakening explosive infrastructure – such as containers holding the gas produced by sewage – and cracks in reservoirs. They said Thames’s management and the regulator, Ofwat, had been slow to address these problems, allowing them to escalate.

The supply of water to the capital is on a “knife-edge”, insiders claim, saying the scale of deterioration of Thames’s critical infrastructure and pressures on its staff have not been grasped by regulators or the company.

Thames Water is labouring under £15bn of debt and has said it cannot repay some of its lenders. The company serves 16 million customers across London and the south-east.

Whitehall sources fear that it will inevitably face a form of temporary renationalisation that will ultimately come at huge expense for the taxpayer.

Current and former staff claimed that Thames Water’s finances were so dire that managers had tried to block or slow down spending on critical chemicals, forcing them to order water treatment chemicals without agreement from senior management. Processes had become so slow, with costs above £50,000 being subject to additional checks from senior bosses, that the only way to keep clean water flowing was to “proceed without approval”, staff said.

A spokesperson for Thames Water said: “We take a rigorous approach to financial discipline throughout the company in order to operate within budget, as any business in turnaround would be expected to do.”

Several staff also claim there is a culture of intimidation on costs. With management unwilling to approve the necessary budgets, it was impossible to order basic, urgent IT upgrades, leaving a key part of the UK’s critical national infrastructure exposed to cyber-attacks, they claimed. Staff claimed that they had been belittled by senior figures in meetings and correspondence when asking for extra resources.

Others claim that after inspecting critical infrastructure such as reservoirs they were asked by managers if they had deliberately manipulated images to show cracks and other signs of deterioration.

The state of Thames and its peers’ debt piles, as well as their impact on the environment, has triggered public debate over how weak regulation may have allowed decades of exploitative privatisation and financial mismanagement. Thames Water’s cash pile was being burned through at far more rapid rate that was initially expected this year, sources claimed, as repairs regarded as critical for safety become imperative.

Thames Water now needed £23bn to repair its failing infrastructure, sources claimed. There were also fears that the figure could balloon further as a “catch-22” of regulatory pressure to cut costs and keep bills low comes after years of “doing less than the bare minimum”, a senior source at the company said.

With about £15bn in debt for its operating company, the total bill posed by Thames being thrust into a form of temporary renationalisation could be as high as £38bn. However, much of the debt could be wiped out and creditors forced to shoulder losses in such an event.

Thames is close to securing a £3bn debt lifeline, without which it faces insolvency by Christmas.

The £23bn needed is an estimate based on a series of reviews of the state of its assets, including the network of pipes and treatment works that provide water to 16 million customers. It relies on interviews with water quality experts, IT technicians and health and safety professionals and documents to work out the latest costs involved in urgent repairs.

The rate of deterioration across all aspects of the water company’s operations has gathered pace such that a previous disclosure of £19bn in failing assets, reported by the company in 2023, is now regarded as a significant underestimate.

It goes some way to explaining the accelerating cash burn at the company that led it to warn this autumn that it needed more time to make payments on its debts. Its deteriorating credit rating now breaches its obligations under its licence, granted by Ofwat.

While some managers and workers have tried to make changes at the company, many have quit or become disillusioned with the senior leadership team and some board members.

A Thames Water spokesperson said: “The wellbeing and safety of our colleagues and customers is our highest priority. We supply 2.6bn litres of water every day, rated among the highest quality of drinking water anywhere in the world.

“We’ve been very open about the ‘asset deficit’ we face, and the challenges we will have meeting future demand if it’s not addressed. That’s why we have set out an ambitious plan for 2025-30 which asks for £20.7bn of expenditure and investment with an additional £3bn through gated mechanisms, so that we can meet our customers’ expectations and environmental responsibilities.

“Further, we take our requirements to protect customers’ personal data and maintain essential services extremely seriously. We regularly review our systems to ensure their continued reliability.”

An Ofwat spokesperson said: “The Guardian has raised a number of serious allegations about Thames Water. We will take action if there is evidence of breach of the company’s obligations.

“We have been pushing Thames Water to make significant improvements in its operational performance and financial resilience for some time. It is of course essential that all water companies provide a safe and reliable water supply. The company has made a request for a substantial increase in expenditure, including to address issues of asset health, as part of the current price review process. We are reviewing that request and the supporting information provided, and will announce our final decisions in December.

“In assessing the business case put forward by companies and in our enforcement work, we work closely with other regulators where needed and seek their views. This includes the Drinking Water Inspectorate in regard to security and cyber measures related to water services, and the Health and Safety Executive and National Cyber Security Centre on matters relating to safety and cybersecurity.”

A spokesperson for the Drinking Water Inspectorate, which regulates water companies, said: “The Drinking Water Inspectorate considers the provision of a continuous, safe supply of clean drinking water to be the highest priority of a water company. Furthermore, this is a duty under the regulations. Where there are any circumstances which give rise to a concern to drinking water, the company are required to notify the inspectorate.

“Similarly, water company staff are able report matters directly to the inspectorate. In both cases the inspectorate will carry out an investigation and will take action as necessary to maintain the high standard of drinking water in England. The inspectorate carry out a programme of risk-based audits to identify, monitor and verify areas of concern, and take enforcement action based on our enforcement policies.”