Could a cyber attack wipe out the UK's food supply and energy in two years? What the NCSC actually said

What is being shared

The Sun's share headline on 3 November was "Cyber attack 'could wipe out UK's food supply & energy in 2yrs', warns spy boss". Its opening line said the UK "faces an attack on its critical infrastructure that could wipe out food supplies and the electric grid in two years", and it said the NCSC "warns Russia, China and Iran will routinely use artificial intelligence to achieve their political goals".

Metro ran "UK faces AI-boosted attacks on critical infrastructure in 'two years or less'", and quoted a security commentator, Will Geddes, saying attacks "could happen within the next two months". That is his view, not the NCSC's.

What the NCSC actually said

The report is the NCSC's Annual Review 2026, subtitled The State of the Cyber Nation, covering 1 September 2025 to 31 August 2026. Its threat chapter says: "By 2028, it is highly likely China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals with the UK facing an increase in scale and speed of sophisticated cyber attacks." And: "It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI." CNI is critical national infrastructure. Iran is not in that sentence, though the Review names Iran-linked groups elsewhere.

"Highly likely" is the NCSC's assessment term, short of certain, and the claim is a ransomware attack on a piece of infrastructure, not a blackout. The Review's pessimistic scenario, the nearest thing in it to a wipe-out story, says its purpose "is not to predict the future, but to illustrate the consequences of inaction". "Two years" is the news release's phrase; the report says "by 2028".

The food line is from the launch speech by Dr Richard Horne, the NCSC's chief executive (the NCSC is part of GCHQ). Leaders who "do not take the responsibility now to make different choices", he said, will one day have to look their investors, employees and customers in the eye and explain why: "When food isn't on the shelves, when lights aren't on, businesses have gone under. We may have to explain that we saw the warning signs, understood the risks and still didn't make the right choices." A warning to organisations about accountability, not a forecast of empty shelves.

Two more lines from the speech matter. On timing: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents. But we must be clear, that is not because AI has invented new ways to attack us." On China: it "highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure".

The numbers in this year's review

Metro's figures match the Review, though its "had been compromised" for the 8,500 is firmer than the Review's "suspected compromise". In the year to 31 August 2026 the NCSC received 1,831 reports of cyber attacks; 337 incidents needed support from its team, of which 80 were classed as nationally significant; and its Early Warning service notified 8,500 organisations of events that pointed to a suspected compromise.

Last year's Review reported 429 incidents needing support and 204 nationally significant, itself up from 89 the year before. So intake rose a little (1,727 tips then, 1,831 reports now), but the handled count fell, from 429 to 337, and nationally significant incidents from 204 to 80. The NCSC names no single cause; it says reporting "does not follow a simple year-on-year trend", that past peaks were often linked to "a small number of particularly significant incidents", and that Early Warning likely "headed off a number of incidents". Read it neither as a surge nor as an all-clear. Dr Horne's "real prospect" of a rise is about the coming months.

Could it turn off your power or water?

We know of no confirmed case of a cyber attack cutting the power or water supply to UK homes. The Review's example is abroad: an attack on Poland's energy grid in December 2025, attributed to Russia's FSB Centre 16, which "if it had been successful, could have caused 500,000 citizens to lose electricity". It was not successful.

What Britain's big attacks have meant in practice is disruption through organisations: paused production at Jaguar Land Rover (about £196 million in direct costs, the Review says), cancelled hospital appointments, some empty food shelves at Marks & Spencer. Our standing cyber guide goes through that record. The Review says the tools and standards to protect UK organisations "already exist" and that most successful attacks still exploit familiar weaknesses.

What it means for your household

The NCSC issued no new instruction for households; its advice is for organisations. The government's Be Ready cyber page covers the home side: a passkey where a service offers one; strong, unique passwords with 2-step verification; a password manager; updates installed and automatic, unsupported devices replaced; and photos and files backed up, with a practice run at restoring them. Start with your email account.

Reporting is simple: scam texts to 7726, scam emails to report@phishing.gov.uk. If you have lost money or been hacked, call Report Fraud on 0300 123 2040 in England, Wales or Northern Ireland (it replaced Action Fraud on 4 December 2025; the number is unchanged), or Police Scotland on 101.

The physical side is the ordinary Be Ready kit, because an attack on an organisation reaches you as a power cut, a card machine that is down or a closed service. A battery or wind-up radio and some cash cover most of it; our cyber attack guide has the full list.

What not to do

Don't panic-buy. Nothing in the Review or the speech asks households to stock anything; the Be Ready checklist is three days of basics, built up gradually.

Don't pay anyone selling "AI-proof" kit or protection off the back of this report. The NCSC's point is the opposite: the protections already exist and most attacks still exploit familiar weaknesses. For a household, the Be Ready steps cost little or nothing.

Watch for scams that borrow the headline. Treat any text or email about "the cyber attack" that wants your login or a payment as a scam until you have checked it another way. And don't read a commentator's "within two months" as the NCSC's view: the Review says 2028, and Dr Horne's "coming months" was about incident numbers, not the grid.