The UK Warns of AI-Powered Cyberattacks on Critical Infrastructure by 2028 as the National Cyber Security Centre highlights growing ransomware risks. Its latest assessment raises concerns about outdated technology, AI-assisted hacking and the security of essential services.
UK AI Cyberattack Warning
Britain's National Cyber Security Centre (NCSC) has warned that artificial intelligence could make cyberattacks faster, cheaper and harder to contain. Its annual review, published on November 3, 2026, calls for stronger protection of essential infrastructure.
NCSC Chief Executive Richard Horne said years of underinvestment had left organisations exposed. He warned that attackers could exploit existing weaknesses on a much larger scale with AI tools.
AI Ransomware Threat by 2028
The NCSC considers it highly likely that AI-powered malware will be used in a ransomware attack against Britain's critical national infrastructure by 2028.
Such attacks could affect organisations responsible for electricity, water, transport or healthcare. AI may help criminals identify vulnerable systems and automate parts of their operations. The assessment describes a serious risk, not a confirmed attack plan or guaranteed nationwide disruption.
UK Critical Infrastructure Security
Many essential services still depend on ageing equipment and software. Horne warned that weak security in industrial control systems could expose electricity networks, water facilities and manufacturing operations.
The NCSC also highlighted risks from supply chains and poorly protected technology. Recent cyber incidents have shown how weaknesses in connected systems can disrupt services beyond the original target.
China Russia Iran Cyber Threats
The NCSC identified China as particularly well positioned to use AI in operations targeting Britain's strategic infrastructure. The assessment also warned about Russian cyber activity and malicious operations linked to Iran.
Horne said Russia continued attempts to access military networks, while Iran remained active in global cyber operations. These statements reflect the UK government's threat assessment, rather than independently established responsibility for a particular future attack.
UK Cyber Defence Measures
The NCSC urged organisations to replace outdated systems, strengthen network security and address known vulnerabilities before attackers exploit them.
The government is also developing AI-assisted tools to identify weaknesses across critical infrastructure. Officials say stronger cyber resilience, responsible AI adoption and better supply-chain protection will help reduce potential disruption.
For households, existing UK emergency guidance recommends keeping basic supplies for interruptions such as power or water outages. That advice applies to emergencies generally and does not signal a specific impending cyberattack.
