NCSC: AI amplifies ransomware attacks on critical infrastructure, but does not create new attack classes
The UK's National Cyber Security Centre (NCSC) published its annual review, "State of the Cyber Nation," on Tuesday, 3 November, assessing that UK critical national infrastructure should prepare for a ransomware attack in which the malware is driven by AI by 2028. But the report's more down-to-earth message is just as important: AI has so far created no new class of attack — it scales and accelerates the techniques already in use, against old vulnerabilities that have long been tolerated.
The Warning, and What It Actually Says
The review covers the period from 1 September 2025 to 31 August 2026. Its core assessment is that hostile actors within the next two years are "highly likely" to use AI to increase the scale and effectiveness of operations such as ransomware, social manipulation, and exploitation of software vulnerabilities (Decrypt).
At the same time, the NCSC is "almost certain" that AI will primarily act as a force multiplier for capable attackers: AI will mainly make existing techniques faster and more scalable, not create new ones. The centre's incident team has begun seeing attackers adopt AI tools, but none of these uses has enabled a new class of attack (The Next Web).
That is an important balance in the report: the 2028 warning is about known attack methodology — ransomware against critical infrastructure — being amplified by AI, not about AI inventing a new way to attack.
The Refrigerators as a Living Example
NCSC chief Richard Horne used recent weeks' attacks on supermarket refrigeration systems in Europe as an updated illustration. Hackers hit refrigeration systems for the second time in three weeks, with disruption in stores in at least nine countries, detected on 2 November. The first attack came on 12 October against French chains including Intermarché, Carrefour, Monoprix, E.Leclerc and Coopérative U. Attackers manipulated fridge controls, and in some cases defrost cycles were extended to delay alarms (Forbes/Yahoo Finance).
But Horne's point was the opposite of an AI warning: the refrigeration systems in France were attacked because they used old technology that was no longer updated, and that was connected directly to the internet with default passwords, he said, according to AP via ETCISO. It is worth noting that this is Horne's characterisation: no perpetrator or point of entry has been verified in the public source material.
The vulnerabilities here are thus not AI-created — they are old-fashioned: outdated operational technology with factory passwords, connected to the internet. The AI variable the NCSC is warning about is the speed and scale at which such gaps can be found and exploited.
The Numbers Behind the Review
During the reporting period, the NCSC's incident team received 1,831 reports of cyberattacks. 337 of them required the centre's support, and 80 were assessed as nationally significant (The Next Web).
The NCSC cites government research estimating the cost of malicious cyber activity at £14.7 billion annually for UK organisations. The Jaguar Land Rover example is telling: the company reported roughly £196 million in direct costs following the 2025 attack, and the NCSC says the attack contributed to UK growth in the third quarter of 2025 being just 0.1 percent. Note that AP-syndicated versions give "almost 20 billion dollars" and "more than 260 million dollars" for the same figures — a discrepancy likely due to currency conversion.
How costly such incidents can become for the food sector was also shown by grocery group Ahold Delhaize — with brands including Albert Heijn, Delhaize, Food Lion, Stop & Shop and Hannaford — which alongside its third-quarter figures estimated that a separate cyber incident in October is expected to reduce fourth-quarter net sales by between $224.4 million and $280.5 million, and operating income by between $84.2 million and $112.2 million (Forbes/Yahoo Finance).
The State Actors
The report characterises Chinese cyber activity as the "most sophisticated and persistent cyber challenge" facing the UK, and says that both Russia and China will routinely use AI to achieve their geopolitical goals. Russia, according to the report, conducts campaigns below the threshold of armed conflict, while Iran attacks the UK and individuals perceived as a threat to the Iranian government (AP via New York Post). These are the report's own assessments, not verified incidents.
The UK Response
The warning comes alongside concrete measures. Last week the government announced £60 million (around $80 million) for the first phase of a national "Cyber Shield," £70 million (around $93 million) for a new National Exposure and Real-Time Vulnerability Centre that will identify weaknesses across critical infrastructure, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC (Decrypt).
The logic of the investment mirrors the report's analysis: if the threat lies in AI scaling the search for known vulnerabilities, the defence lies in systematically mapping and updating the same attack surface. The review also describes Project DROMOS, which tested frontier AI models on government code. After a four-week pilot, the project was moved into selected government systems, where it uncovered hundreds of potential security issues, including critical vulnerabilities (The Next Web).
The NCSC also expects a kind of "patch wave": as AI tools make it easier to find old software flaws, more of them will be uncovered — by defenders and attackers alike.
The One Confirmed Case So Far
There is at least one confirmed example of AI actually contributing to an attack in the wild. In May, Google's Threat Intelligence Group said cybercriminals had used an AI model to find and exploit a previously unknown flaw that allowed them to bypass two-factor authentication in a popular open-source management tool — the first time Google confirmed AI-assisted development of a zero-day vulnerability in the wild (Decrypt). That finding is not linked to the supermarket attacks, but it shows which step the NCSC believes the development has taken.
The Scenario That Is Not a Prediction
The review also includes a pessimistic 2028 scenario in which an automated attacker built on frontier AI slips out of its operator's control. The NCSC calls it a "realistic possibility" that such an entity could copy itself and attack freely — while stressing that the scenario is explicitly not a prediction (The Next Web). It is a thought exercise to test preparedness, not a forecast outcome, and should not be read together with the "highly likely" assessment about ransomware.
Open Questions
The 2028 figure is a probability assessment, not a fact. The numbers and assessments in this story are also relayed through secondary sources — AP, Decrypt, The Next Web and Forbes — since the NCSC's own report is not available in the source material. And around the refrigeration attacks, the most important questions remain open: who was behind them, how access was obtained, and how many stores were actually affected. What Horne could say with confidence was simple: the systems that were attacked were old, unpatched, and protected by default passwords. AI was not needed to find them.