NCSC warns AI ransomware is highly likely to hit UK infrastructure by 2028

Britain’s next major cyber threat may exploit weaknesses that organizations already know about. The National Cyber Security Centre’s annual review warns that ransomware using AI-powered malware is “highly likely” to hit UK critical infrastructure by 2028. Its assessment points to AI making familiar attacks more efficient, not simply creating entirely new ways to break in.

Familiar attacks, faster execution

The warning covers services well beyond government computer networks. The UK’s definition of critical national infrastructure spans energy, transport, defence, food, health and finance. Power stations, airports and hospitals are among the facilities exposed to the threat described in the review.

Ransomware attackers gain access to a victim’s systems, encrypt files with malicious software and demand payment to restore access. They may also demand payment over stolen data. The NCSC says AI can assist several stages of that operation: scouting targets, finding weaknesses in networks and writing malicious code.

The annual report expects AI to increase the scale and efficiency of hostile operations. But, according to Associated Press reporting, it judges that AI is more likely to enhance existing tactics than find entirely new vulnerabilities. That distinction makes the warning as much about neglected security work as about advances in AI.

The assessment is a forecast, not a disclosure that the predicted ransomware attack has happened. Alongside it, the review expects Russia and China to use AI routinely in cyberattacks. It describes Chinese cyber activity as the most sophisticated and sustained cyber challenge facing the UK.

A warning with a longer history

The 2028 horizon is not new. In a June 17 statement, the NCSC assessed that attackers would likely use AI-enabled capabilities by then to exploit known weaknesses in legacy technology across critical infrastructure at scale. The annual review now gives that horizon a specific ransomware scenario.

That earlier statement also described the existing workload. The agency managed more than 200 cyber incidents affecting UK critical infrastructure and its supporting ecosystem in the year to May 2026. Around 75% were believed to be linked to state actors. Those figures describe the wider cyber threat, not a count of AI-powered attacks.

In remarks prepared for a speech accompanying the annual review, NCSC chief executive Richard Horne is due to warn of a possible unprecedented rise in cyber incidents in the coming months. He attributes the danger to AI uncovering weaknesses in IT systems that have been tolerated for too long.

For decades we have collectively got away with tech on the cheap

Richard Horne, NCSC chief executive, in prepared remarks reported by the Guardian

The bill for neglected systems

Horne’s warning extends to the physical processes computers control: electricity switching, water-facility gates, dam operations, manufacturing lines, heating and refrigeration. He cites recent attacks on refrigeration systems in French supermarkets as an example of civilian infrastructure’s exposure. The stakes are therefore not confined to stolen files or unavailable websites.

Cyber disruption already carries a substantial financial cost. The NCSC puts malicious cyber activity’s annual cost to UK organizations at almost $20 billion. Jaguar Land Rover suffered more than $260 million in direct losses after a 2025 cyberattack that also affected suppliers. That historical example illustrates the cost of disruption; it is not evidence of AI involvement.

The agency’s immediate advice starts with basic controls rather than a requirement to buy AI tools:

• Keep devices up to date.
• Limit administrator access to systems.
• Back up important files and data.

The NCSC’s June guidance also urged leaders to understand their exposure and ensure their organizations can keep operating and recover quickly after an attack. Prevention is only part of the task: the agency is asking organizations to prepare for what happens when their defences fail.