UK Cyber Agency Warns an AI Powered Ransomware Attack on Critical Infrastructure Is Highly Likely by 2028

Britain should be prepared for an AI powered cyberattack on its critical national infrastructure in the next two years, the National Cyber Security Centre, the NCSC, said on Tuesday, November 3, 2026, in its annual report. The agency said it was highly likely there would be a ransomware attack involving AI powered malware by 2028 on the nation's critical infrastructure. The judgement is a forecast in an official assessment. No such attack was reported on Tuesday.

The NCSC warned that AI powered malicious software is highly likely to be used in cyber attacks by financially motivated hackers against UK power stations, airports and hospitals by 2028. It also said nation states including Russia and China will routinely use AI in cyber activity by that date.

What the agency chief said

NCSC chief executive Richard Horne, whose agency is part of GCHQ, said China was likely the best equipped to conduct such operations. "We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces," Horne said. He said Russia was making sustained attempts to penetrate UK military networks, and that Iran was carrying out malicious cyber operations globally, including against the UK. Moscow, Beijing and Tehran have all repeatedly denied similar accusations in the past.

Horne warned of a sharp rise in incidents. "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he said in a speech prepared for the annual review launch. He put the cause on old weaknesses, not new AI tricks. "But we must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable," he said. He added: "For decades, we have collectively got away with doing tech on the cheap."

The year in numbers

Between September 2025 and August 2026, the NCSC received 1,831 reports of attacks on UK organisations, up from 1,727 a year earlier. The agency gave hands-on support in 337 cases, down from 429, and classed 80 of the cases as nationally significant. The figures show a rising volume of reported attacks at the same time as the agency's hands-on caseload fell, which is the backdrop to the warning that defences built for a slower threat are now under strain.

The annual review is the agency's public account of the threat picture for the year. Its central message for the next two years is direct: prepare for AI powered ransomware against the systems the country depends on every day, and fix the long tolerated vulnerabilities that such malware would exploit first.