UK Warns AI Cyberattacks Could Hit Critical Infrastructure by 2028

Richard Horne, head of the National Cyber Security Center, said artificial intelligence could help attackers find and exploit long-standing weaknesses at much greater scale. AI is more likely to boost existing methods than uncover entirely new vulnerabilities, the NCSC’s annual report said.

The report describes Chinese cyber activity as the UK’s leading cyber threat in terms of sophistication and persistence. Horne said Russia is conducting cyber campaigns that stay short of armed conflict, while Iran is attacking the UK and targeting people considered threats to its government.

Potential targets include systems controlling electricity, water facilities, dams, manufacturing, heating and refrigeration. Horne pointed to cyberattacks on refrigeration systems at French supermarkets, where hackers raised temperatures and food thawed. A separate attack on Poland’s energy grid in December 2025 was attributed by the UK and EU member states to Russia’s FSB; a successful attack could have left 500,000 people without power in winter.

The NCSC says malicious cyber activity costs UK organizations almost $20 billion annually. Jaguar Land Rover sustained more than $260 million in direct losses from a 2025 cyberattack, which also affected suppliers and the UK economy.

GCHQ director Anne Keast-Butler urged organizations to act, including by updating devices, restricting administrator access and backing up important data. Horne warned that leaders who skimp on technology and security could be held responsible if essential services fail.

Underinvestment Leaves UK Infrastructure Exposed to AI Cyberattacks

The warning from cyber chief Richard Horne is also a warning about the consequences of organizations treating security as an expense to defer. AI could let attackers exploit weaknesses at a far greater scale, while outdated systems help put electricity, water, food supplies and businesses in danger.

The NCSC says hostile cyber activity costs UK organizations almost $20 billion a year. Jaguar Land Rover’s 2025 cyberattack caused more than $260 million in direct losses and hit suppliers as well as the wider UK economy. Horne said leaders who have relied on cheap technology may have to answer for outages, empty shelves and failed businesses.

The threat is not abstract: hackers targeting refrigeration systems at French supermarkets raised temperatures and caused food to thaw. Systems controlling electricity, dams, water facilities, manufacturing and heating can also be exposed to attack. The UK and EU member states said Russia’s FSB was behind a 2025 attack on Poland’s energy grid that could have cut power to 500,000 people in winter.

The NCSC says AI will probably scale familiar tactics rather than uncover entirely new vulnerabilities. Its recommended defenses include updating devices, limiting administrator access and backing up data. Treating those basic protections as optional leaves customers, workers and essential services carrying the risk of choices made by organizational leaders.

UK Must Strengthen Defenses Against AI-Enabled State Cyberattacks

The warning highlights a national security challenge that Britain cannot afford to treat as a distant technology problem. Richard Horne said China poses the UK’s most persistent and advanced cyber threat, while Russia and Iran are also conducting hostile operations.

AI is likely to make those operations larger and more efficient, the NCSC says, even if it mainly improves existing tactics rather than producing entirely new ways to break into systems. Critical targets include electricity controls, water facilities, dams, manufacturing, heating and refrigeration—the systems that keep daily life running.

The danger has already been demonstrated. UK and EU member states attributed a 2025 attack on Poland’s energy grid to Russia’s FSB; if successful, it could have deprived 500,000 people of electricity during winter. Hackers have also disrupted refrigeration in French supermarkets by raising temperatures until food thawed.

Organizations have a responsibility to protect the infrastructure on which the country depends. The NCSC recommends keeping devices updated, restricting administrator access and backing up important data. With malicious cyber activity costing UK organizations almost $20 billion annually, leaders who continue to neglect basic defenses risk leaving services, businesses and the public exposed.