UK Cyber Chief Warns AI Cyberattacks on Critical Infrastructure by 2028

The United Kingdom’s National Cyber Security Centre has issued its starkest warning yet: AI-powered malware is “highly likely” to be used in a ransomware attack against the nation’s critical infrastructure by 2028. The announcement, delivered by NCSC CEO Dr. Richard Horne on November 3, 2026, accompanies the publication of the agency’s annual review and paints a sobering picture of a nation that has relied on “tech on the cheap” for far too long.

A Two-Year Countdown to AI-Driven Cyber Warfare

The NCSC’s State of the Cyber Nation report makes clear that the convergence of artificial intelligence and cybercrime is not a distant theoretical concern. It is an imminent operational threat. According to the report, AI adoption by hostile actors—including criminal syndicates and state-sponsored groups from Russia and China—is “highly likely” to increase both the scale and efficiency of attacks within the next two years.

Dr. Horne’s message to business leaders was unflinching: organizations that have “got away with tech on the cheap” will soon have to explain why “food isn’t on the shelves, lights aren’t on, businesses have gone under.” The era of deferred security investment is ending, and the consequences of neglect are about to become visible at a pace that outdated incident response frameworks cannot match.

The Supermarket Fridge Attack: A Wake-Up Call

The NCSC’s warning gained urgent credibility from a series of cyberattacks that swept across Europe in late October and early November 2026. Hackers targeted internet-exposed refrigeration controllers in supermarkets across France, Belgium, Sweden, Ireland, the Netherlands, Estonia, and Finland. The attackers cranked temperatures up to 50 degrees Celsius (122 degrees Fahrenheit), causing frozen food to thaw and spoiling produce worth millions of euros.

The UK was not spared. The NCSC confirmed that British businesses in the food supply chain, including meat processing firms, were among those affected. The agency’s teams “worked through the night” to contact organizations with vulnerable refrigeration systems. The British Association of Independent Meat Suppliers reported that some of its members saw their cold units spike to 100 degrees Celsius.

Critically, Dr. Horne emphasized that the supermarket fridge attacks were not AI-powered. They exploited long-known vulnerabilities in outdated operational technology systems that had been connected directly to the internet with default passwords. The incident demonstrates precisely the kind of neglected security gaps that AI will soon be able to discover and exploit “at a scale that was once unimaginable.”

Why Operational Technology Is the Soft Underbelly

The supermarket attacks highlight a broader and more troubling reality: the technology that controls physical processes vital to modern life—electricity switching, water facility sluice gates, dam operations, manufacturing lines, heating and refrigeration controls—is often running on obsolete software with minimal security controls.

• Default credentials: Many IoT and operational technology devices ship with factory passwords that are never changed.
• End-of-life systems: Organizations are running systems beyond their manufacturer’s support window, leaving unpatched vulnerabilities open.
• Internet exposure: Control systems that were never designed for public internet access are now reachable from anywhere on the globe.
• Flat network architecture: Operational technology networks are often not segmented from corporate IT, allowing attackers to pivot from a phishing email to physical infrastructure.

As AI tools become more capable of automated vulnerability discovery, each of these weaknesses becomes a target that can be identified and exploited at machine speed rather than human speed.

Government Response: Investment and Legislation

The UK government is not standing still. In conjunction with the NCSC report, the Chancellor announced several major investments in cyber defence capabilities:

• £60 million for the first phase of a national Cyber Shield
• £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify vulnerabilities across critical infrastructure
• A new AI Cyber Security Centre of Excellence in Manchester, operated by the NCSC
• The forthcoming Cyber Security and Resilience Bill and National Cyber Action Plan

These investments signal a recognition that traditional perimeter-based security models are insufficient against AI-augmented threats. The NERV Centre, in particular, represents a shift toward continuous exposure management—a model where organizations actively hunt for their own vulnerabilities before adversaries do.

What Organizations Must Do Now

The NCSC report is not simply a government-level concern. It carries direct implications for every organization that relies on connected technology. The following actions are no longer optional:

1. Inventory and Segment Operational Technology

Organizations must maintain a complete inventory of all connected devices, including those in operational technology environments. Any device that controls a physical process should be isolated from the public internet and segmented from corporate networks. Where remote access is necessary, it should be mediated through secure gateways with multi-factor authentication.

2. Eliminate Default Credentials

Every device—whether a refrigeration controller, a security camera, or a smart thermostat—must have its default password changed to a strong, unique credential. This is the most basic security hygiene step, yet the supermarket attacks prove it remains widely neglected.

3. Adopt AI for Defence, Not Just Offence

The same AI capabilities that threaten to accelerate attacks can also be used to strengthen defences. AI-powered threat detection, automated patch management, and continuous vulnerability scanning are becoming essential tools. Organizations that fail to adopt AI for security will find themselves outpaced by adversaries who do.

4. Invest in Resilience, Not Just Prevention

No defence is perfect. Organizations must assume that breaches will occur and invest in resilience—backup systems, incident response plans, and recovery procedures that can restore operations quickly. The supermarket attacks showed that the inability to quickly disconnect and manually control refrigeration systems turned a manageable incident into a multi-million-euro loss.

5. Prepare for Regulatory Compliance

The Cyber Security and Resilience Bill will impose new obligations on organizations operating critical infrastructure. Early preparation—gap assessments, compliance audits, and remediation plans—will be far less costly than scrambling to meet requirements after enforcement begins.

The Broader Global Context

The UK’s warning resonates beyond its borders. The same vulnerabilities exist in operational technology worldwide. The supermarket fridge attacks affected six nations. The Frontline Education data breach, disclosed in the same week, exposed the personal information of over 1.3 million students and school staff in the United States through a third-party software vulnerability. Google’s dismantling of the XCPE botnet—1.3 million infected Android TV boxes manufactured by a Chinese company that deliberately installed malware—demonstrates that the threat landscape spans consumer devices, enterprise systems, and national infrastructure alike.

Chrome 157’s release, patching 213 vulnerabilities including seven rated critical, further underscores the relentless pace at which new weaknesses are discovered. Notably, 14 of those vulnerability reports were generated with AI assistance, proving that AI is already shaping both sides of the cyber battlefield.

A Moment of Choice

Dr. Horne framed the current moment as one of “enormous consequence” and urged organizations to treat it as a “moment of choice.” The tools, standards, and frameworks to protect against both conventional and AI-powered attacks already exist. What has been lacking is the will to invest and the urgency to act.

The message from the NCSC is clear: the window for voluntary action is closing. By 2028, the question will not be whether AI-powered attacks are possible, but whether organizations chose to prepare when they had the chance. Those that did not will have to answer for the consequences—not to regulators alone, but to the public whose food, water, power, and safety depend on systems that were left exposed.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous