AI-powered cyberattacks on UK infrastructure likely by 2028

The United Kingdom faces a growing threat from AI-powered cyberattacks on critical infrastructure by 2028, according to Britain’s cyberchief. Richard Horne, head of the National Cyber Security Center, warned that criminals and state actors, including China and Russia, are increasingly leveraging AI in their cyber activities. Horne highlighted the potential for AI to discover and exploit “vulnerabilities that have been tolerated for far too long,” leading to attacks on a scale previously unimaginable.

One example of this threat was demonstrated when hackers exploited vulnerabilities in refrigeration units, causing food to thaw. The UK has also faced similar attacks, and Horne emphasized that businesses and organizations must invest in cybersecurity or explain why "food isn't on the shelves, lights aren't on, businesses have gone under" if they fail to modernize their technology.

Chinese cyberactivity is identified as the most sophisticated and sustained challenge to the UK, while Russia and China are expected to routinely use AI to advance their geopolitical goals.

Russia intentionally conducts cyber campaigns that fall short of armed conflict, while Iran targets individuals deemed threats to the Iranian government. Horne stressed that AI will likely enhance and scale existing cyber tactics and techniques rather than create entirely new vulnerabilities. He noted that technology "underpins the automation of physical processes vital to modern life," including electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls.

The recent cyberattacks on refrigeration systems in French supermarkets serve as a stark example of how hostile actors could exploit civilian infrastructure with ease. Horne recounted the NCSC's efforts to contact organizations with vulnerable technology operating in refrigeration systems across Europe, including the UK, after the French attacks. Although the attacks on French refrigeration systems were not AI-driven, they underscored the urgent need for businesses to address the security of their operational technology.