LONDON — Britain needs to be ready for a ransomware attack powered by AI against its critical infrastructure within the next two years, the National Cyber Security Centre said on Tuesday.
The warning is in the centre’s annual review, published Tuesday. The centre, part of the GCHQ spy agency, judged it highly likely that attackers will use AI-powered malware in a ransomware attack on the country’s critical infrastructure by 2028, and that hostile actors will use AI to run bigger and more efficient operations over the same period.
Richard Horne, the centre’s chief executive, put the problem down to old weaknesses, not new tricks. Far too many organisations and supply chains in Britain had got away with “doing tech on the cheap” for decades, he said. Flaws that were tolerated for years can now be found and exploited at a scale that was once unimaginable.
“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,”
Horne said China highly likely has the intent, and is best positioned, to use AI for operations against Britain’s critical infrastructure and other strategic targets. He called Chinese activity the most sophisticated and sustained cyber challenge the UK faces. Russia, he said, is making sustained attempts to penetrate UK military networks, and Iran is carrying out malicious cyber operations globally, including against the UK. Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malicious cyber activity in the past.
The review covers the year to Aug. 31, 2026. The centre received 1,831 reports of cyberattacks on UK organisations in that time, gave hands-on support in 337 cases and classed 80 incidents as nationally significant. Malicious cyber activity costs UK organisations about £14.7 billion a year, the centre said.
Horne told organisations to act now or be ready to explain themselves later — why, when food is not on shelves and the lights are not on, they saw the warning signs, understood the risks and still did not make the right choices. The Chancellor has announced £60 million for the first phase of a national Cyber Shield and £70 million for a centre to find weaknesses across critical infrastructure and the wider economy.
The same risk has been flagged closer to home. Virginia Gov. Abigail Spanberger ordered a statewide plan for AI-related cyberattacks last month, directing state agencies to prepare for attacks that use AI against government systems and services.
Have something to promote?
Bring your business, services or event to our readers.