UK Could Face 'Hacktivist Attacks at Scale' in Conflict, Security Agency Head Warns
The United Kingdom could experience hacktivist attacks at scale if it becomes involved in a conflict, with impacts potentially mirroring recent high-profile ransomware incidents, according to Richard Horne, chief executive of the National Cyber Security Centre (NCSC). In a speech at the CyberUK conference in Glasgow, Horne emphasized that nation states now represent the most significant threats handled by the NCSC, and the UK must prepare for scenarios where paying ransoms is not an option.
Ransomware Attacks as a Benchmark for Future Threats
Ransomware gangs, which demand payments to unlock encrypted IT systems, have targeted numerous British organisations in recent years, including Marks & Spencer, Jaguar Land Rover (JLR), and Royal Mail. The attack on JLR, for instance, slowed UK economic growth by disrupting car production. Horne warned that hacktivist attacks in a conflict could achieve similar levels of disruption and sophistication, but without the possibility of ransom payments to aid recovery.
He stressed that every public and private sector organisation must prioritize cybersecurity to defend against such threats. Embedding cybersecurity into corporate missions is essential, ensuring that risks are fully understood and defences are layered to prevent initial breaches from escalating into catastrophic impacts.
Geopolitical Tensions and Technological Challenges
Horne echoed previous warnings from MI6 chief Blaise Metreweli, who described the UK as being in a space between peace and war amid rising tensions with Russia. Horne highlighted that cyberspace is a key battleground in this contest, with rapid technological changes and geopolitical pressures creating a perfect storm of uncertainty.
He also addressed the role of frontier AI, such as the Mythos model, which can quickly identify vulnerabilities in systems. While advanced AI has not yet led to significant new attacks, Horne urged organisations to use AI defensively to patch security gaps and update outdated systems, rather than falling behind in the cybersecurity arms race.
Call to Action for Enhanced Cyber Defences
The NCSC chief called for a proactive approach, warning that the UK must not rely on ransom payments as a fallback. Instead, organisations should build robust, in-depth defences to mitigate risks. This includes regular system updates, vulnerability assessments, and integrating cybersecurity strategies into core business operations to withstand evolving threats from hacktivists and state actors alike.
