UK cyber agency expects AI-assisted attacks on critical services by 2028

single source· 1 articles · confidence: low · first seen 2026-11-03 00:01 UTC

What this means for you

Nothing to act on today — this is a forecast, not an incident. But a 2028 date is now attached to AI-assisted ransomware in the UK's official assessment, so anyone running or supplying critical services has that in their planning horizon. The analysis behind it is not published.

The National Cyber Security Centre, the UK's state cybersecurity body, expects AI-assisted malicious software to be used in attacks on the country's power stations, airports and hospitals by 2028, and says AI will probably enable a ransomware attack on critical national infrastructure before then. The UK's definition of critical national infrastructure spans energy, transport, defence, food, health and finance, among other sectors. The assessment is a forecast, not the report of an incident; this account rests on a single report, which does not set out the analysis behind it.

Key facts

  • ·The National Cyber Security Centre is the UK's state cybersecurity body. source
  • ·The NCSC says AI-assisted malicious software is likely to be used in attacks on UK critical infrastructure by 2028. source
  • ·The NCSC says AI will probably enable a ransomware attack against critical national infrastructure between now and 2028. source
  • ·The UK's definition of critical national infrastructure covers energy, transport, defence, food, health and finance, among other sectors. source
  • ·The report was published on 3 November 2026. source

What the sources say

  • The Guardian AI — Reports the NCSC's warning that AI-assisted ransomware against utilities and hospitals is expected within two years.

Sources

The original reporting. Follow these — they did the work.

← the wire