UK cyber agency warns of AI-powered ransomware on critical infrastructure by 2028

NCSC's annual review

In its annual assessment The State of the Cyber Nation, published on 3 November, the UK's National Cyber Security Centre (NCSC) said an AI-powered ransomware attack on critical national infrastructure will highly likely occur by 2028.

The NCSC operates within GCHQ, the UK's intelligence agency. The warning amounts to an official assessment of how AI is accelerating attack tooling.

What it means

Ransomware is a type of attack that encrypts data on a target system and blocks access to demand payment. AI-powered variants can largely automate the reconnaissance, spread and targeting phases of an attack.

Critical national infrastructure covers essential services such as energy, water, transport and health. An attack on such systems could cause widespread disruption.

State actors also in focus

The NCSC's review says it also expects hostile states to develop similar capabilities. Details on state actors remain limited because the full warning text was only partially quoted in The Next Web's report.