NCSC warns AI-powered ransomware likely to hit UK infrastructure by 2028

The NCSC already sits behind Britain's response to major ransomware incidents, from the 2017 WannaCry attack that froze NHS trusts to the 2021 Colonial Pipeline shutdown in the US, where the ransom was paid in bitcoin. Those cases showed how a single intrusion into energy, water or health systems can cascade into public disruption. The new report folds large language models and automated exploit tools into that same playbook, arguing they make known intrusion methods cheaper and faster rather than inventing new ones.

Operators of power grids, water utilities and hospital networks now have a concrete planning horizon, 2028, to harden systems against attacks that arrive faster and probe more targets at once. Security teams will need to compress patching cycles and assume attackers can automate reconnaissance that once took weeks. Insurers pricing cyber cover and crypto exchanges that monitor ransom payment flows both face a shorter window to detect and freeze funds before AI-assisted actors move faster than current response playbooks allow.

Cheaper, faster intrusion tools cut both ways: the same automation that helps a ransomware crew scale an attack can help defenders triage alerts and patch faster, and the NCSC's own report leans on that argument. The harder question is whether AI mainly lowers the floor for less-skilled criminals, widening the pool of groups capable of hitting infrastructure, or mainly accelerates attackers who were already capable. Regulators have not settled it, and the UK's own debate over banning ransom payments to public bodies remains unresolved.