What AI Cyberattacks Could Mean for UK Power, Water and Food Supplies

Britain will likely face cyberattacks powered by artificial intelligence on its critical infrastructure by 2028, the head of the country's National Cyber Security Center warned Tuesday, according to the Associated Press. The risk covers the services people rely on every day, from electricity to water to food supply chains.

Richard Horne, the center's chief executive, said criminals and states, including China and Russia, are increasingly using AI in their cyber activity. He spoke as the center published its annual cyber report.

What it means for everyday services

Horne said technology underpins the automation of physical processes vital to modern life, including electricity switching, sluice gates at water facilities, dam operations, manufacturing lines, and heating and refrigeration controls.

He pointed to recent attacks on refrigeration systems in French supermarkets as proof of how easily hostile actors can exploit civilian infrastructure. He warned that leaders of organizations that have cut corners on technology could one day have to explain why food is missing from shelves, lights are off and businesses have collapsed.

What the report says about AI

The report says AI could bring AI-powered malware for ransomware attacks, and could help attackers find and exploit weaknesses that have been tolerated for too long. Horne said this could happen “at a scale that was once unimaginable.”

The report is more measured on the details. It says the use of AI by states and criminals is highly likely to increase the scale and efficiency of hostile operations, but that AI is more likely to be used to enhance existing tactics and techniques than to discover entirely new vulnerabilities.

It describes Chinese cyber activity as the most sophisticated and sustained cyber challenge facing the U.K. and says Russia and China will routinely use AI to pursue their geopolitical goals. Horne said Russia is deliberately running cyber campaigns that stay below the threshold of armed conflict, and that Iran is carrying out attacks against the U.K. and targeting people it sees as threats to its regime.

The numbers behind the warning

• 2028: the year by which Britain is likely to face AI cyberattacks on critical infrastructure.
• Almost $20 billion: what malicious cyber activity costs U.K. organizations every year, according to the center.
• More than $260 million: direct losses suffered by carmaker Jaguar Land Rover in 2025 after a cyberattack that also hit suppliers and dented the U.K. economy.
• 500,000: the number of people who could have lost electricity in winter if a December 2025 attack on Poland's energy grid had succeeded. The U.K. and EU member states said Russia's FSB security service was behind it.
• 70%: the share of websites worldwide that rely on a programming language in which AI helped find two critical flaws last week, prompting urgent security updates from governments and corporations.

What the agency wants organizations to do

Anne Keast-Butler, director of GCHQ, the signals intelligence agency of which the center is part, said every organization in the U.K. needs to act now. She said cybersecurity is now part of the front line of the country's defense.

The center recommended basic measures: keeping devices up to date, limiting administrator access to systems and backing up important files and data. Horne said organizations that fail to invest in security or to replace outdated technology will be expected to answer for the consequences.

Around Prague, based on reporting by The Independent, ABC News