UK cyber chief says AI attacks on water and power systems likely by 2028
Britain's National Cyber Security Center says criminals and states will use AI to go after critical infrastructure. Valley farms and cities depend on the same kinds of machinery it named.
UK cyber chief says AI attacks on water and power systems likely by 2028
Key Takeaways
- Richard Horne, head of Britain's National Cyber Security Center, said AI cyberattacks on U.K. critical infrastructure are likely by 2028.
- Horne named electricity switching, water sluice gates, dam operations, manufacturing lines and refrigeration controls as systems at risk.
- The NCSC said malicious cyber activity costs U.K. organizations almost $20 billion a year.
- The agency's advice is basic: update devices, limit administrator access and back up important data.
Last month, attackers hit the refrigeration systems in French supermarkets.
On Tuesday, Britain's top cyber official said that kind of attack is a sign of what's coming. Richard Horne, head of the U.K.'s National Cyber Security Center, said Britain will likely face artificial intelligence cyberattacks on its critical infrastructure by 2028 as criminals and states, including China and Russia, increasingly use AI, The Associated Press reported. He was talking about Britain. But the systems he named are the kind the Central Valley's farm economy depends on every day: sluice gates at water facilities, dam operations, electricity switching, refrigeration controls and manufacturing lines.
Horne said technology "underpins the automation of physical processes that are vital to modern life."
The French supermarket attacks, he said, showed how easily hostile actors could exploit civilian infrastructure.
What the report found
Horne spoke as the NCSC released its annual cyber report. He said AI-powered malware could drive ransomware attacks, with the technology allowing "vulnerabilities that have been tolerated for far too long" to be discovered and exploited "at a scale that was once unimaginable."
The report was more careful on one point. It said AI is highly likely to make hostile operations bigger and more efficient, but that attackers will more likely use it to scale up tactics they already have than to find brand new weaknesses.
It called Chinese cyber activity the "most sophisticated and sustained cyber challenge facing the U.K." Horne said Russia is running campaigns that stay below the threshold of armed conflict. He also said Iran is attacking the U.K. and targeting people it sees as threats to the regime.
Who pays for it
Horne put the responsibility on the people at the top. He said leaders of businesses and organizations of all sizes who have "got away with tech on the cheap" will have to answer for it if they don't invest in cybersecurity or replace out-of-date technology.
The losses are already adding up. Malicious cyber activity costs U.K. organizations almost $20 billion a year, the NCSC said. Carmaker Jaguar Land Rover lost more than $260 million directly after a 2025 cyberattack that also hit its suppliers.
The U.K. and EU member states have said Russia's FSB security service was behind an attack on Poland's energy grid in December 2025. If that attack had worked, 500,000 people could have lost electricity in the middle of winter, according to the AP.
What it means in the Valley
The warning is about Britain. For Valley readers the takeaway is simple: the tools Horne described don't stop at national borders, and this trend will reach Fresno, Bakersfield and Stockton the same way it reaches everywhere else.
Last week showed how fast that can happen. Governments and corporations rushed out urgent security updates after AI helped find two critical flaws in a programming language that 70% of websites around the world depend on, the AP reported. In theory, the flaws could let an attacker take control of a web server remotely without a password.
The fixes the NCSC recommends are basic. It said organizations should make sure devices are up to date, limit administrator access to systems and back up important files and data.
"We need every organization in the UK to take action now," said Anne Keast-Butler, director of GCHQ, Britain's signals intelligence agency, which includes the NCSC. She said cybersecurity "is now part of the front line defense of our nation."
Horne said executives who skimp on security will be the ones explaining why "food isn't on the shelves, lights aren't on, businesses have gone under."
Central Valley AI is produced by the CVAI Newsdesk team and developed by Kaweah Tech, a regional firm that builds, deploys, and integrates AI solutions for businesses across California's Central Valley.