The head of the National Cyber Security Centre (NCSC) warned that the UK must urgently confront rising cyber threats from Russian aggression and sophisticated Chinese hackers.

Richard Horne, delivering his first major speech since becoming the NCSC chief in October, emphasized a “widening gap” between the UK’s defenses and the escalating risks posed by state-backed and criminal cyber actors.

Mr. Horne highlighted the findings of the NCSC’s annual report, which reveals a threefold increase in severe cyber incidents in 2023-24 compared to the previous year. These incidents underscore the vulnerabilities in critical infrastructure, public services, and businesses.

“What has struck me more forcefully than anything else since taking the helm at the NCSC is the clearly widening gap between the exposure and threat we face, and the defenses that are in place to protect us. And what is equally clear to me is that we all need to increase the pace we are working at to keep ahead of our adversaries.”
Richard Horne

Richard Horne

The report singles out Russia as a major cyber aggressor, describing it as a “capable, motivated, and irresponsible threat actor in cyberspace.” State-backed groups and non-state actors inspired by Russia’s actions in Ukraine have carried out attacks on critical infrastructure worldwide.

Mr. Horne warned: “We can see how cyber attacks are increasingly important to Russian actors, along with sabotage threats to physical security.”

China’s cyber capabilities, meanwhile, are described as “highly sophisticated.” Groups linked to Beijing have been implicated in targeting US and UK institutions, including MPs’ emails and the Electoral Commission’s database. Some Chinese-linked operations, like the Volt Typhoon group, are suspected of laying the groundwork for disruptive attacks on critical infrastructure.

The report also highlights growing threats from Iran and North Korea. Iranian cyber actors are described as developing capabilities to carry out disruptive attacks on the UK, while North Korean hackers are targeting cryptocurrency and defense data. Alarmingly, North Korea is also suspected of deploying operatives posing as freelance IT professionals to siphon revenue for the regime.

Human Costs Of Cyber Attacks

The report details the real-world consequences of cyber incidents, such as the ransomware attack on Synnovis in June 2024. The attack, attributed to a Russian gang, disrupted health services, while a separate breach of the British Library in October 2023 highlighted how deeply technology is entwined with access to knowledge and culture.

Mr. Horne stressed: “The attack against Synnovis showed us how dependent we are on technology for accessing our health services. And the attack against the British Library reminded us that we’re reliant on technology for our access to knowledge.”

Over the past year, the NCSC handled 1,957 reports of cyber incidents, with 430 requiring direct intervention from its incident management team. Of these, 89 were deemed nationally significant, including 12 classified as extremely severe—a threefold increase from the previous year.

Adding to the complexity of the threat is the increasing role of artificial intelligence (AI) in cybercrime. According to Cabinet Office Minister Pat McFadden, AI is revolutionizing the cyber threat landscape, enabling criminals to scale up attacks.

“As this report shows, while AI presents huge opportunities, it is also transforming the cyber threat,” Mr. McFadden said. “Cyber criminals are adapting their business models to embrace this rapidly developing technology – using AI to increase the volume and impact of cyber attacks against citizens and businesses, at a huge cost.”

The report warned that the UK must enhance its cyber resilience across critical infrastructure, supply chains, the public sector, and the wider economy. Failing to act swiftly risks leaving the nation vulnerable to an ever-evolving and increasingly potent array of threats.