UK Says AI-Powered Ransomware Attack on Critical Infrastructure 'Highly Likely' by 2028

What it is

The UK National Cyber Security Centre (NCSC, part of GCHQ) published its annual State of the Cyber Nation report on 3 November 2026. It says critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028.

The "highly likely" wording in the page attaches to a narrower claim. The NCSC says hostile actors' use of AI is highly likely to increase the scale and efficiency of ransomware, social engineering and software vulnerability exploitation within two years. The page does not quote the report as calling the 2028 attack itself highly likely.

How it works

NCSC chief executive Richard Horne frames AI as a multiplier on old weaknesses, not a source of new attack techniques. In prepared remarks, Horne said vulnerabilities "tolerated for far too long" can now be discovered and exploited at a scale that was once unimaginable.

The evidence cited is mixed. In May 2026, Google's Threat Intelligence Group said criminals used an AI model to find and weaponize an unknown flaw that bypassed two-factor authentication in a popular open-source administration tool. Google called this its first confirmed case of AI-assisted zero-day development in the wild. A Cambridge University study of more than 90,000 cybercrime forum threads, published the same month, found most criminals use AI for spam and phishing, not sophisticated attacks.

What to do

Horne's stated advice to organizations has three parts:

• Invest properly in technology, ending what Horne called "tech on the cheap".
• Stop connecting systems to the internet unnecessarily.
• Treat the government's Cyber Essentials certification as the starting point for security, not the end goal.

Caveats

The page gives no technical detail, indicators or mitigations beyond those three points. It does not describe what the AI-powered malware would do. The government funding announcements (£60 million Cyber Shield, £70 million vulnerability centre, a Manchester AI Cyber Security Centre of Excellence) are context only and give an engineer nothing to deploy. The full report is linked from the NCSC's post but was not part of the fetched text.