AI-Powered Cyberattacks on UK Infrastructure Likely by 2028

The United Kingdom will likely face artificial intelligence cyberattacks on its critical infrastructure by 2028 as criminals and states, including China and Russia, increasingly use AI in their cyberactivity, Britain’s cyberchief said Tuesday.

That could include AI-powered malware for ransomware attacks as the technology will allow “vulnerabilities that have been tolerated for far too long” to be discovered and exploited “at a scale that was once unimaginable,” said Richard Horne, the head of the National Cyber Security Center.

One such vulnerability was discovered in refrigeration units that were targeted by hackers who turned up the temperature, causing food to thaw. The UK has also been affected, Horne said.

In a speech marking the publication of the annual cyber report by the National Cyber Security Center, or NCSC, Horne said that the leaders of businesses and organizations of all sizes who have “got away with tech on the cheap” will have to explain why “food isn’t on the shelves, lights aren’t on, businesses have gone under,” if they fail to invest in cybersecurity or update out-of-date technology. Chinese cyberactivity is the “most sophisticated and sustained cyber challenge facing the UK” while both Russia and China will routinely use AI to achieve their geopolitical goals, the report said. Russia is intentionally conducting cybercampaigns which fall below the threshold of armed conflict, while Iran is carrying out attacks against the UK and targeting individuals who are a threat to the Iranian government, Horne said.

The use of AI by states and criminals is highly likely to increase the scale and efficiency of hostile operations, but AI is more likely to be used to enhance and scale existing tactics and techniques rather than find brand new vulnerabilities, the report said.

Technology “underpins the automation of physical processes that are vital to modern life,” Horne said. That includes, he said, electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls. The recent cyberattacks on refrigeration systems in French supermarkets showed how easily hostile actors could exploit civilian infrastructure, Horne said. Fridges across Europe have been affected, including in the UK, where security experts from the NCSC worked “through the night” to contact organizations with the vulnerable technology, Horne told The Associated Press.

Refrigeration systems in France were attacked because they were using old technology which was no longer being updated and that was connected directly to the internet with default passwords, Horne said. It was, he said, not an AI attack but one where bad actors exploited vulnerabilities that have existed for a long time and showed the need for businesses to address the security ofoperational technology.