How can the UK prepare for a cyber-attack? What it has meant at home, and what is worth doing

What is being said this week

Four voices are behind this week’s headlines, saying different things. On 12 October 2026 the AI minister, Kanishka Narayan, said it seems “likely, if not inevitable, that our own cyber defences will be breached”. He meant AI-enabled attacks on the country’s systems, not a blackout.

On 17 October the BBC reported that Lord Ricketts, a former national security adviser, had told Radio 4’s Today programme that hybrid attacks are getting “more reckless, more dangerous”. He wants more resilient energy, transport and air traffic control, and ministers to warn the public. That is about infrastructure, not advice to households; whether Britain is preparing for conflict more broadly has its own dated record.

The most shared line is Sir Grant Shapps’s, in the Daily Express on 18 October: “Russia doesn’t need to invade Britain to threaten Britain”, and the next attack “may look like an ordinary Monday morning when everything suddenly stops working”. It is a former Defence Secretary’s warning, not an official forecast; the article cites no report or assessment behind it and does not say where he said it. The same piece also quotes the head of MI5, Sir Ken McCallum, again without saying where: “You should expect to hear more from government in the coming months on how we can all be more resilient.”

What a cyber attack has actually meant at home

Britain’s large cyber attacks have not looked like films. They looked like cancelled appointments, paused orders and some empty shelves.

Hospitals. On 12 May 2017 WannaCry disrupted 81 of England’s 236 NHS trusts: at least 6,912 appointments were cancelled (NHS England estimated about 19,000 in all), five A&E departments diverted patients, and NHS England knew of no patient data being stolen. On 3 June 2024 an attack on the pathology provider Synnovis left south-east London hospitals at about 10% of testing capacity; in the first week 814 planned procedures, 97 of them for cancer, and 861 outpatient appointments were postponed.

Shops. Marks & Spencer disclosed an attack on 22 April 2025, paused online orders on 25 April and took 46 days to restart them. Some food shelves emptied and contactless payment was affected. Customer data was taken, though not usable card details or passwords, and customers were warned to expect fake messages.

Industry. Jaguar Land Rover halted production on 1 September 2025, the day after an attack, and did not begin a phased restart until 8 October, more than five weeks later.

The global IT outage of July 2024 was a faulty CrowdStrike update, not an attack. At home the effect can look the same, and the Risk Register now plans for both.

Could a cyber attack cut your power or water?

Not so far. There is no confirmed case of a cyber attack cutting the power or water supply to British homes. South Staffs Water’s August 2022 attack affected its IT and data, not the supply.

The nearest thing came in July 2026, when a small-scale energy generator went offline for four days after a reported cyber attack. DESNZ, the energy department, said “at no point was there a risk to the wider energy system”; there has been no formal attribution, and no homes were reported to have lost power. Headlines called it a power plant; it was not the grid.

It has happened abroad, in Ukraine in December 2015 and December 2016, during its conflict with Russia: not a precedent for Britain.

So the attacks Britain has had hit organisations, and the disruption reached households through them. The basics below are the ones you would keep for a storm anyway.

What the government’s planning assumes

The National Risk Register, published on 14 July 2026, is the public version of the government’s planning, and this edition added new cyber risks: an attack on a water company’s operational technology, in which the company loses visibility and control of its systems and disruption could take “several months” to put right; a cyber attack on data infrastructure such as data centres; and a “digital resilience failure”, added to reflect lessons from the July 2024 CrowdStrike outage.

A reasonable worst case is a planning assumption, not a forecast: the worst plausible version of a risk, used so that emergency services and utilities plan in proportion, not what the Register expects this winter. Our guide to the Register explains how to read it.

The household advice is GOV.UK Prepare, whose emergency kit list is written for any emergency and does not single out cyber attacks. The Cabinet Office said on 2 October that a national campaign built on it will launch “later this autumn”, promoting “simple, low cost and free actions” and the Priority Services Register. Where the campaign stands.

The Defence Secretary has separately suggested households keep a supply of bottled water indoors and some tinned food they could eat if a power cut stopped them cooking; the government stressed that no big purchases are needed. No official source tells you to stockpile; our stockpiling fact-check has the record.

What to do now: the household basics

None of this is specific to cyber attacks, which is the point: the same few things cover a storm, a flood, a long power cut or a day when the tills stop working.

Water and food. GOV.UK Prepare says a minimum of 2.5 to 3 litres of drinking water per person per day, plus non-perishable food that needs no cooking and a tin opener. It gives no number of days; the British Red Cross and Ready Scotland both work on three days’ supply. Our emergency kit list follows the official list item by item; the kit builder sizes it to your household.

A radio. GOV.UK Prepare says to keep a battery or wind-up radio and spare batteries, because updates may be broadcast by radio; try FM and digital, and write the frequencies on paper. In a written answer in December 2025 the government said the BBC’s power-outage plan aims to keep key radio channels broadcasting nationally. Which radio to buy, and how to use it in a power cut.

Light, power and numbers. A battery or wind-up torch and a charged power bank. Prepare warns that mobiles may stop if the local mast is affected, so write important phone numbers on paper, among them 105 for power cuts (England, Scotland and Wales). A household emergency plan puts numbers, shut-offs and a meeting point on one sheet.

Medication and documents. Several days of any medication you rely on, and your documents to hand. If anyone at home relies on powered medical equipment, or is older or disabled, ask your suppliers about the Priority Services Register.

Cash. GOV.UK Prepare does not mention cash and there is no official UK figure; the British Red Cross lists some “for essentials”. For context only, the Netherlands’ national payments forum, chaired by its central bank, advised in May 2025 keeping about €70 per adult and €30 per child for a 72-hour failure of electronic payments, plus more than one way to pay. When the card machine is down explains what a little cash is for.

Your own accounts and devices

The attacks that reach most households are not on the grid but on accounts: a reused password or a convincing email. The National Cyber Security Centre’s advice has six parts: a strong, separate password for your email; the latest updates on your devices and apps; 2-step verification wherever it is offered; a password manager; backups of what you cannot replace; and passwords made of three random words.

Email first: the NCSC puts it at the top of the list, and it is a ten-minute job.

The scale is real: in the year to 31 August 2025 the NCSC handled 429 incidents, 204 of them nationally significant, up from 89 the year before. Those were attacks on organisations. Your part is to make sure that when one of them loses your details, the attackers get no further.

After an attack: the scams that follow

Every big breach is followed by messages pretending to come from the company. Marks & Spencer warned customers to expect fake messages after its 2025 attack.

The pattern repeats: a text or email about your account, a refund or unusual activity, with a link and a deadline. Go to the company’s website or app yourself, not through the link, and never move money because a message told you to.

Forward scam texts to 7726 and scam emails to report@phishing.gov.uk. If money has gone, call your bank; 159 connects you to it. Report fraud in England, Wales and Northern Ireland to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (it replaced Action Fraud on 4 December 2025); in Scotland, report it to Police Scotland on 101. Our guides to AI-enabled scams and what to do if you have been scammed take it step by step.

What not to do

Don’t buy for a scenario. The official list is a few days of basics; the government has stressed that no big purchases are needed, and the campaign is built around “simple, low cost and free actions”.

Don’t read a planning scenario as a forecast. The Risk Register’s water and data-infrastructure scenarios are the worst plausible cases planners prepare for, not what anyone has said to expect this winter.

Don’t mistake a former minister’s warning for an official one. The “ordinary Monday morning” is Sir Grant Shapps’s image, with no published assessment behind it; the head of MI5’s point was that advice is coming, not that an attack is.

And don’t click the link in the message that follows the breach. That is where a company’s breach becomes your loss.