Britain's top cyber official has warned that the United Kingdom is likely to face artificial intelligence-powered cyberattacks on its critical infrastructure within the next three years, as hostile states and criminals increasingly harness AI to scale up their operations.
Richard Horne, head of the National Cyber Security Centre (NCSC), said in a speech on Tuesday that AI will enable attackers to discover and exploit vulnerabilities that have been ignored for too long, at a scale that was previously unimaginable. He pointed to a recent incident where hackers targeted refrigeration units, raising temperatures and causing food to thaw—a scenario that has also affected the UK.
Horne's remarks came as the NCSC published its annual cyber report, which identifies Chinese cyberactivity as the most sophisticated and sustained challenge facing the UK. Both China and Russia are expected to routinely use AI to pursue their geopolitical objectives, while Russia is deliberately conducting cybercampaigns that stay below the threshold of armed conflict. Iran, meanwhile, is carrying out attacks against the UK and targeting individuals seen as threats to the Iranian government.
The report notes that AI is more likely to enhance and scale existing tactics rather than uncover entirely new vulnerabilities. However, the technology underpins the automation of physical processes vital to modern life—electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, and heating and refrigeration controls. Horne stressed that leaders who have “got away with tech on the cheap” will have to answer for failures if they do not invest in cybersecurity.
Outdated systems and real-world consequences
Horne highlighted the recent cyberattacks on refrigeration systems in French supermarkets as a stark example of how easily civilian infrastructure can be exploited. The systems were running outdated technology, connected directly to the internet with default passwords. The attacks, which affected fridges across Europe—including in the UK—were not AI-driven but demonstrated the urgent need for businesses to secure operational technology.
In the UK, NCSC experts worked through the night to contact organisations using vulnerable refrigeration units. The incident underscores the broader risk: as more physical processes become automated and connected, the potential for disruption grows. Horne warned that if businesses fail to update their systems, they could face consequences such as empty shelves, power outages, and even business failures.
The warning comes amid a series of cyber incidents across Europe. Last week, governments and corporations rushed to apply urgent security updates after AI-assisted tools discovered critical flaws in a programming language used by 70% of websites globally. The two vulnerabilities could allow attackers to gain unauthorised access to web servers without a password.
Russia has already demonstrated its willingness to target European infrastructure. In December 2025, an attack on Poland's energy grid, attributed to Russia's FSB security service, could have cut electricity to 500,000 people during winter. The UK and EU member states have condemned the attack, which was narrowly averted.
The financial toll of cybercrime in the UK is staggering: malicious cyberactivity costs organisations nearly $20 billion (€17.9 billion) annually. In 2025, carmaker Jaguar Land Rover suffered more than $260 million (€232 million) in direct losses following a cyberattack that also hit suppliers and dented the national economy.
Anne Keast-Butler, director of GCHQ, the UK's signals intelligence agency, called for immediate action across all organisations. “We need every organisation in the UK to take action now. Not only to protect their customers, services and livelihoods, but because cybersecurity is now part of the front-line defence of our nation,” she said.
The NCSC recommends basic but effective measures: keeping devices up to date, limiting administrator access, and backing up important files. As AI lowers the barrier for cyberattacks, the urgency for robust defences has never been greater. The threat is not just a UK problem—it is a European one, as the continent's interconnected infrastructure remains a prime target for hostile actors.
