UK intelligence has warned that AI-powered ransomware attacks are highly likely to strike the country’s critical national infrastructure (CNI) by 2028. The assessment describes a structural shift in which the barrier to entry for attackers is falling and anonymity is growing—placing nation-grade hacker tools in the hands of novices while making it ever harder for defenders to trace them.
In its “2026 Annual Cyber Security Report” released on the 3rd (local time), the UK National Cyber Security Centre (NCSC) projected that, beginning around 2028, cyberattacks targeting not only government, industry, and civil society but also essential services such as energy, water, transportation, and healthcare will surge significantly. The NCSC is an organization under GCHQ, the UK’s intelligence agency.
The report’s central point is that AI is changing the economics of cybercrime. Attackers use AI tools to automate reconnaissance and vulnerability discovery and to mass-produce phishing messages that deceive people with ease. The skill level required to mount sophisticated attacks has dropped, and execution speed has accelerated. The room for novel techniques that existing defenses struggle to detect has also widened.
Identifying the perpetrator is becoming increasingly difficult. The report anticipates that as the use of proxies—intermediaries who carry out attacks on behalf of others—becomes commonplace, attributing the source of an attack will grow far more complex. The harder it becomes to prove who is responsible, the weaker deterrence becomes, and the lower the negotiating leverage of victim companies seeking compensation.
The most striking change is that damage in cyberspace is spilling over into the physical world. A recent hack targeting the refrigeration and freezing systems of major European supermarkets caused storage temperatures to spike, forcing food to be discarded en masse. Supermarkets in at least 11 countries—starting with France and including Germany, Italy, and the Netherlands—were directly affected. It is a case where damage materialized not as data leaks or system outages but as food spoiling inside refrigerators and store shelves going bare.
The report analyzes that such operational technology (OT) attacks will inevitably become more frequent as they intersect with advanced environments—the spread of AI-controlled robots, cloud-managed critical national infrastructure, and biological laboratories. The more the contact points between the cyber and physical domains multiply, the greater the ripple effects of hacking on human life and equipment safety.
The NCSC stressed that “we must move beyond assessing the consequences of an attack simply as data leaks or system compromise, and include the safety of people and equipment, the continuity of services, and whether systems operate normally within the scope of security.” It added that “in the long term, the goal should be to ensure technology is designed securely from the outset and is resilient by default,” and that “even as these technological changes proceed rapidly, organizations must take practical measures to reduce immediate risk.” It cited strengthening the technological foundation and consistently applying proven security practices as tasks for the next decade.
The UK is already confirming the reality of the threat in numbers. From September 2025 through the end of August 2026, the number of organizations notified of potential compromise indicators through early warnings reached 8,500. That far exceeds the 1,831 cyberattack reports received during the same period. Of these, 337 incidents were judged to require support from NCSC teams after initial classification and review, and 80 of those were classified as nationally significant.
CategoryFigureOrganizations notified via early warning (Sep 2025–Aug 2026)8,500Cyberattack reports received1,831Incidents judged to require NCSC support337Classified as nationally significant incidents80
Note: Based on the UK National Cyber Security Centre (NCSC) annual report
Market observers say the warning is not a factor that will move stock prices immediately. It is, however, sufficient to prompt governments and companies to increase spending on AI-based threat detection tools, cybersecurity solutions, and infrastructure resilience projects. Insurers that underwrite cyber risk and critical infrastructure operators are also likely to re-examine their defenses. Given the established practice of government agencies issuing forward-looking threat assessments first and then justifying budgets and regulations, the 2028 deadline reads less as an “immediate crisis” and more as a “window for preparation.”
The warning shows that AI has become a variable that is reshaping the cyber threat landscape, beyond being a mere productivity tool. Given that the anomaly detection and response tools used by defenders and the vulnerability discovery tools used by attackers stem from the same technological base, policymakers have entered a phase in which they must design regulation and investment on the premise of AI’s dual nature. The NCSC did not present specific attacks, targets, or a detailed timeline beyond 2028. It made clear that the announcement is a risk outlook, not evidence of a planned attack.
South Korea faces the same challenge. President Lee Jae-myung said at a Cabinet meeting the previous day that “above all, we must build a system capable of detecting, disseminating, and responding in advance to signs of attacks on vulnerabilities,” and stressed that “we must fundamentally innovate the existing security system so that we can preemptively block ever-evolving hacking threats.” In the same vein, he called for active consideration of forming a government-wide cybersecurity control tower—a so-called “czar.” The UK case is expected to serve as a reference showing why a control tower that unifies advance warning and post-incident response into a single system is necessary.
Click Here For The Original Source.
——————————————————–
