UK must expect AI-powered attack on critical infrastructure within two years, cyber centre warns
Britain's National Cyber Security Centre says a ransomware attack involving AI-powered malware against critical infrastructure is highly likely by 2028, naming China as best equipped to carry out such operations.
Britain should be prepared for an AI-powered cyberattack on its critical national infrastructure within the next two years, the United Kingdom's National Cyber Security Centre (NCSC) warned on Tuesday, in one of the starkest assessments yet of how artificial intelligence could change the threat facing essential services.
In its annual review, the NCSC, which is part of the GCHQ intelligence agency, said it was highly likely that the country would face a ransomware attack involving AI-powered malware against critical infrastructure by 2028. It also warned that hostile actors were expected to use artificial intelligence to increase the scale and efficiency of their operations over the same period, rather than necessarily inventing entirely new kinds of attack.
NCSC chief executive Richard Horne was due to set out the warning in a speech later on Tuesday, telling organisations that the coming months carried a real prospect of an unprecedented rise in the number of cyber incidents. He has argued that far too many organisations and supply chains have got away with what he called 'doing tech on the cheap' for decades, leaving them exposed when attackers probe for weaknesses.
The centre singled out China as the country likely best equipped to conduct such operations, saying Beijing highly likely had both the intent and the capability to use artificial intelligence against Britain's critical infrastructure and other strategic targets. Horne described China's activity as the most sophisticated and sustained cyber challenge the United Kingdom faces, a characterisation Beijing has repeatedly rejected in the past when similar accusations have been made.
Horne was also due to say that Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the United Kingdom and individuals seen as a threat. Moscow and Tehran have likewise denied similar accusations in the past, and the NCSC's warning is framed as an assessment of intent and capability, not as a claim that a specific new attack has taken place.
The warning comes against a backdrop of heavy operational pressure. The NCSC handled more than 200 cyber incidents affecting critical national infrastructure and its supporting ecosystem in the year through May 2026, according to a June summary of its work, with around three-quarters believed to have links to state actors. That figure covers a broad range of incidents, not AI attacks alone, but it underlines how routinely essential services are now in the sights of hostile operators.
Recent attacks on supermarkets across Europe have sharpened the point for the public, because they showed how a failure in information technology can quickly reach physical operations, from refrigeration to shelves and supply chains. The NCSC's argument is that the same logic applies, with far higher stakes, to energy, water, transport, health and financial systems, where disruption can cascade well beyond a single company.
What makes the artificial intelligence element different, in the centre's assessment, is speed and scale. AI tools can help attackers choose targets more quickly, identify vulnerabilities in networks, and develop malicious code, turning familiar techniques into operations that can be run against many victims at once. Defenders, the centre argues, must therefore fix known weaknesses rather than treating each new tool as a separate, exotic threat.
For organisations running critical services, the practical message is accountability as much as technology. Horne has said that organisations will have to explain why they ignored known risks despite being aware of the warnings, a signal that the centre expects boards and senior managers, not only technical teams, to own the decisions that leave legacy systems unpatched or poorly monitored.
The annual review does not predict a particular date, target or method, and it does not say that an AI-powered ransomware attack on British infrastructure has already happened. Its purpose is to set a planning horizon: by 2028, the NCSC believes, such an attack is highly likely, and the work to harden systems, practise recovery and close known gaps needs to happen before that horizon arrives, not after it.
More in News
NewsNew Zealand's final poll puts National one point ahead of Labour, with Opportunity Party holding the balance of power
NewsTwo helicopters collide below Mount Everest base camp in Nepal, killing one tourist and injuring two others
News