UK cyber chief predicts AI ransomware strike on critical systems by 2028

The United Kingdom expects an AI-powered ransomware attack on its critical national infrastructure by 2028, according to the National Cyber Security Centre. The agency, which operates under the GCHQ spy agency, released this warning in its annual report on Tuesday, citing a shift in how hostile actors utilize artificial intelligence to exploit existing system weaknesses.

Richard Horne, the chief executive of the NCSC, stated that the threat is not new technology but rather the scale of exploitation. He noted that vulnerabilities tolerated for decades can now be discovered and leveraged at a volume previously unseen. The report projects a real prospect of a surge in cyber incidents in the coming months as AI enhances the efficiency of these operations.

China is identified as the best-equipped nation to conduct such operations against UK strategic targets. Horne described Chinese activity as the most sophisticated and sustained cyber challenge facing the country. While Russia and Iran are also active threats, with Russia making sustained attempts to penetrate military networks and Iran targeting individuals globally, Beijing holds the primary position for large-scale infrastructure strikes.

Horne criticized the current state of British technology procurement, arguing that many organizations and supply chains have relied on low-cost solutions for too long. This approach, he argued, left the sector vulnerable to automated detection and exploitation. The warning follows recent hacking incidents across European supermarkets that revealed significant gaps in IT systems.

The agency called for immediate corrective action from private and public sector leaders. Horne stated that if essential services fail, such as food supplies or lighting, the sector must explain why it ignored the warning signs. The report emphasizes that the window for fixing these foundational issues is narrowing as AI-driven tools become more accessible to hostile states.

Moscow, Beijing, and Tehran have historically denied accusations of malevolent cyber actions. The NCSC’s assessment places the financial burden of these potential disruptions on the entities that have delayed modernization of their digital infrastructure. The coming two years represent the critical period for implementation of these upgrades before the predicted 2028 deadline arrives.