Britain's doomsday warning: AI hackers could knock out UK power, water by 2028, cyber agency warns | Gravitas

Days after the UK government urged households to keep a three-day supply of essential items, a new warning has emerged about a threat that could disrupt the country's critical infrastructure. Britain's National Cyber Security Centre (NCSC) has said the country should prepare for an AI-powered cyberattack targeting essential services within the next two years.

In its annual report, the NCSC said it was highly likely that Britain's critical infrastructure would face a ransomware attack involving AI-powered malware by 2028. It also warned that hostile actors could use artificial intelligence to increase the scale and efficiency of their operations over the same period.

UK organisations warned of growing cyber threat

NCSC Chief Executive Richard Horne said too many organisations and supply chains in Britain had relied on cheap technology for decades, leaving them exposed to cyber threats.

He warned that the country could face an unprecedented increase in cyber incidents, attributing the risk to long-standing vulnerabilities that had not been addressed.

"We must be clear, that is not because AI has invented new ways to attack us. It is because vulnerabilities that have been tolerated for far too long can now be discovered and exploited, at a scale and pace that was once unimaginable," Horne said.

China, Russia and Iran identified as cyber threats

Speaking about the potential sources of cyber threats, Horne said China was best equipped to carry out such operations. "And we know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets, with their activity representing the most sophisticated and sustained cyber challenge the UK faces."

He also said Russia was making sustained attempts to penetrate the UK's military networks, while Iran was conducting malicious cyber operations around the world, including against the UK and individuals it considered threats.

Moscow, Beijing and Tehran have repeatedly denied similar accusations in the past.

Major cyberattacks that have hit critical infrastructure

The warning comes against the backdrop of several major cyberattacks that have targeted countries and critical infrastructure over the years.

In 1988, the Morris worm became the first computer worm to spread across the internet. In 2010, the US-Israeli cyber weapon Stuxnet targeted Iran's nuclear programme.

In 2017, the WannaCry ransomware attack and the destructive NotPetya malware struck hospitals, banks and shipping ports around the world.

In 2020, the SolarWinds supply chain hack compromised updates to the company's Orion software, allowing attackers to infiltrate numerous US federal agencies and major technology companies.

A year later, the Colonial Pipeline attack by the DarkSide syndicate forced the shutdown of a major US fuel pipeline.

Warning follows cyberattacks on European supermarkets

The NCSC report comes after hacking attacks on supermarkets across Europe exposed weaknesses in their IT systems.

Horne said organisations needed to act urgently to address their vulnerabilities, warning that failing to make the right decisions despite the available warnings could have serious consequences.