UK cyber agency warns AI-powered ransomware will likely hit Britain's power, water or food systems by 2028
The head of the National Cyber Security Centre says AI isn't inventing new attacks, it's finding old, unfixed weaknesses faster, and he is urging companies to fix them now.
Britain's National Cyber Security Centre, part of the GCHQ spy agency, warned Tuesday that the country's essential services should brace for a ransomware attack using AI-powered malware by 2028.
Ransomware is malicious software that locks a victim's computers until they pay. Critical infrastructure means systems such as power, water, hospitals and food supply. The agency's new State of the Cyber Nation report says hostile groups are "highly likely" to use AI over the next two years to scale up ransomware, scams and the exploitation of software flaws.
Old weaknesses, found faster
The agency's chief executive, Richard Horne, said in prepared remarks that AI is not inventing new ways to attack. Instead, it lets attackers discover and exploit long-tolerated weaknesses "at a scale that was once unimaginable."
For decades, we have collectively got away with doing tech on the cheap
He urged organizations to invest in upgrading old technology, disconnect systems that do not need to be on the internet, and treat Britain's basic Cyber Essentials security standard as a starting point. He said AI is also a chance to strengthen defenses.
The UK government last week announced 60 million pounds for a national "Cyber Shield" and 70 million pounds for a new center to find weaknesses across critical infrastructure, the agency said. The report covers only the UK.
Source: UK National Cyber Security Centre, Nov. 3, 2026.