UK Warns of AI-Powered Cyberattacks on Critical Infrastructure by 2028

LONDON, Nov 3: Britain could face artificial intelligence powered cyberattacks targeting its critical infrastructure by 2028, the country’s top cybersecurity official has warned, highlighting growing concerns over the use of advanced technology by criminal groups and hostile state actors.

Richard Horne, head of the UK’s National Cyber Security Centre (NCSC), said artificial intelligence was increasingly being used to strengthen cyber operations, potentially allowing attackers to identify and exploit weaknesses in digital systems on a much larger scale.

Speaking during the release of the NCSC’s annual cyber report on Tuesday, Horne warned that organisations relying on outdated technology and inadequate security arrangements could face serious consequences as cyber threats become more sophisticated.

He said AI could enable attackers to discover vulnerabilities that had remained undetected for years and exploit them more efficiently. The technology could also make existing cybercrime methods faster, more targeted and easier to scale.

The warning comes amid growing dependence on interconnected digital systems across essential sectors, including electricity distribution, water management, manufacturing, transportation and food supply chains.

Cybersecurity experts have increasingly raised concerns that attacks on these systems could extend beyond data theft and financial losses, potentially disrupting services that millions of people depend on every day.

According to the NCSC, artificial intelligence is highly likely to increase the scale and efficiency of malicious cyber operations conducted by both state-sponsored groups and criminal organisations.

However, the agency indicated that AI would primarily improve existing methods of cyberattacks rather than necessarily introduce entirely new techniques for discovering security weaknesses.

The distinction is significant because organisations already facing conventional cyber threats may now have to deal with attackers capable of carrying out familiar operations more quickly and across a wider range of targets.

Horne warned that businesses and institutions that had avoided investing in proper cybersecurity measures could eventually be held responsible for the consequences of preventable failures.

He stressed that organisations must replace outdated technology and strengthen their digital defences instead of relying on inexpensive systems that may no longer provide adequate protection.

The cybersecurity chief also highlighted the risks associated with attacks on operational technology, which controls physical processes in essential infrastructure.

Such systems are responsible for managing electricity switching, water facilities, dam operations, industrial production lines, heating equipment and refrigeration systems.

A successful attack on these networks could potentially interrupt essential services, damage equipment and create serious economic disruption.

The NCSC pointed to recent cyberattacks targeting refrigeration systems at French supermarkets as an example of how digital vulnerabilities could affect ordinary commercial operations.

The incident demonstrated that cyber threats were no longer limited to conventional computer networks and could directly affect physical infrastructure and supply chains.

Britain has also highlighted concerns about hostile cyber activity linked to Russia, China and Iran.

According to the NCSC’s assessment, Chinese cyber operations represent the most sophisticated and sustained state-linked digital challenge facing the United Kingdom.

The agency warned that Russia and China were increasingly likely to use artificial intelligence to advance their geopolitical objectives through cyber operations.

Russia has also been accused of conducting cyber campaigns designed to remain below the threshold of conventional armed conflict.

Meanwhile, Iran has been linked to malicious cyber activity targeting individuals considered threats to its government, according to the warning.

The growing use of AI by state-linked groups could make it more difficult for organisations to identify suspicious activity before it causes significant damage.

The NCSC also highlighted an incident involving Poland’s energy infrastructure in December 2025, which British and European authorities attributed to Russia’s Federal Security Service.

Officials said the attack could have resulted in electricity disruptions affecting approximately 500,000 people during winter if it had succeeded.

The incident underlined the vulnerability of energy networks and the importance of protecting systems that support essential public services.

Britain’s cybersecurity authorities have also drawn attention to the financial consequences of digital attacks.

Malicious cyber activity is estimated to cost UK organisations nearly USD 20 billion annually, demonstrating the significant economic impact of cybercrime.

The attack on car manufacturer Jaguar Land Rover in 2025 was cited as another example of the damage that cyber incidents can cause to businesses and their wider supply chains.

The company suffered more than USD 260 million in direct losses following the incident, which also affected suppliers and created wider disruption to the British economy.

The case highlighted how a cyberattack against one major organisation could have consequences extending across multiple industries.

Anne Keast-Butler, director of Britain’s signals intelligence agency GCHQ, urged organisations across the country to take cybersecurity seriously.

She said digital security had become an essential component of national defence, requiring businesses and institutions to protect their customers, services and operations against increasingly sophisticated threats.

The NCSC recommended several basic security measures that organisations could implement to reduce their exposure.

These include keeping software and devices updated, restricting administrator privileges, maintaining regular backups of important information and ensuring that access to sensitive systems is properly controlled.

Limiting administrative access is particularly important because attackers who obtain high-level privileges can potentially gain control over critical networks and compromise large amounts of information.

Regular backups can also help organisations restore essential data and resume operations following ransomware incidents or other destructive cyberattacks.

The agency’s warning reflects a broader shift in cybersecurity priorities as artificial intelligence becomes increasingly integrated into business operations, public administration and industrial infrastructure.

While AI offers significant opportunities to improve productivity, automate processes and strengthen services, its growing use also creates additional security challenges.

Businesses are increasingly adopting automated systems to analyse information, manage operations and support decision-making. However, these technologies can introduce vulnerabilities when connected to poorly protected networks or outdated software.

The challenge is particularly serious for organisations operating essential infrastructure, where a digital failure can have consequences beyond financial losses.

For example, disruptions to electricity management systems could affect hospitals, communication networks and industrial facilities. Attacks on water management systems could interfere with treatment and distribution, while compromised manufacturing networks could interrupt production and supply chains.

The increasing sophistication of cyber threats also means that organisations cannot rely solely on traditional security arrangements.

They may need to strengthen monitoring systems, improve employee awareness, conduct regular security assessments and establish procedures for responding quickly to suspected attacks.

The NCSC’s assessment serves as a warning that cybersecurity investment must keep pace with technological development.

Although the agency identified 2028 as a potential timeframe for AI-enabled attacks against critical infrastructure, the warning does not mean that every organisation will face an attack by that date.

Instead, it highlights the need for governments, businesses and infrastructure operators to prepare for a changing threat environment.

As artificial intelligence continues to develop, the ability to protect essential digital and physical systems will become increasingly important for national security and economic stability.

The UK’s warning also reinforces the importance of international cooperation, information sharing and stronger cybersecurity standards to address threats that can cross national borders.

With essential services becoming more dependent on interconnected technologies, protecting digital infrastructure is emerging as one of the major challenges for governments and businesses in the coming years.