UK cyber agency warns AI-powered malware is highly likely to hit critical infrastructure by 2028

An AI-driven threat within two years

The National Cyber Security Centre (NCSC), part of the GCHQ intelligence agency, says AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure before 2028. The warning appears in the agency's annual State of the Cyber Nation report, published on Tuesday, 3 November 2026, which names power stations, airports and hospitals among the facilities at risk. The NCSC counts energy, transport, defence, food, health and finance as covered sectors. It expects AI to help ransomware gangs, which typically operate out of former Soviet Union states, scout targets, locate weaknesses in IT networks and write malicious code. In his speech launching the report, NCSC chief executive Richard Horne argued that AI now lets attackers find weaknesses in IT systems that have been neglected for years.

China, Russia and the scale of the threat

The report calls China the most sophisticated and sustained cyber challenge facing the UK, and Russia the most audacious. It cites a December 2025 attack on Poland's energy grid, attributed to a cyber unit within the Russian security services, which would have affected 500,000 citizens had it succeeded. So far, hackers have mostly used AI for reconnaissance, tailored phishing and finding software flaws rather than fully automating attacks. This year the NCSC has received 1,831 reports of cyber attacks affecting UK organisations, 80 of which were classed as nationally significant.

Reports received1,831

Classed as nationally significant80

Reports received

1831

Classed as nationally significant

80

Data from the article text

Horne said flaws that were once tolerated can now be exploited at a scale the country could not previously imagine.

“Vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

He also said society had for decades got away with building technology on the cheap, and that leaders who fail to invest would have to explain to investors, staff and customers why shelves were empty, lights were off and businesses had failed.

Supermarket freezers and meat processors

An unidentified attacker hacked freezers in dozens of European supermarkets on Monday, 2 November 2026, raising temperatures and spoiling food. The Evening Standard reports that meat processing firms in the UK have also been hit, and that the attack on French supermarket fridges involved legacy technology connected to the internet with default passwords. The NCSC said it is working with the affected firms and had staff working through the night to alert British companies whose exposed technology it could see was vulnerable. Horne told BBC Radio 4 that a handful of UK organisations had been alerted and that a couple of impacts were known, adding that it was too early to say who was behind the attack. Paul Chichester, the agency's director of operations, put the national picture in a single sentence.

“At the moment, the impact is minimal.”

Government response and costs

In October 2026 the government set out plans to increase funding for AI security. On Tuesday, 3 November 2026, it announced around £10 million to help small and medium-sized British businesses protect themselves against cyber threats. The report says malicious activity costs British organisations about £14.7 billion a year, an amount it says matches the size of the UK's cybersecurity sector. Also in October 2026, the government urged Britons to stock up on up to nine litres of bottled water and three days' worth of food to survive a weather, cyber or other serious emergency. Wes Streeting, described by the Guardian as the defence secretary, said Britain must prepare for state-sponsored terrorism by Russia or other hostile powers targeting everyday infrastructure.

Wider backdrop

The FT links the warnings to a spate of high-profile attacks on companies and infrastructure worldwide, many of which may have been aided by AI tools. The freezer attacks followed the theft in late October 2026 of $6.3bn in cryptocurrency from Binance, the world's largest crypto exchange. Horne urged businesses he described as willfully blind to face up to the risk of a sharp rise in incidents in the coming months. The NCSC expects Britain to face a growing scale and speed of sophisticated attacks over the next two years.