Cyberattacks Are Hitting Essential Services Harder Than Ever, NCSC Warns

A successful cyber attack on energy, water or transport networks would interrupt daily life across the UK within hours. The National Cyber Security Centre has told operators of critical national infrastructure to prepare for that risk now, not after systems fail.

The alert follows events in Poland, where authorities disclosed that critical infrastructure was targeted just after Christmas. Coordinated attacks hit a heat and power plant and renewable energy generators. Polish officials compared the attempted disruption to arson, a reminder that digital intrusions can damage physical assets.

Jonathon Ellison OBE, Director for National Resilience at the NCSC, wrote on LinkedIn: “Cyber attacks disrupting everyday essential services may sound far-fetched, but we know it’s not.” He said UK operators “must not only take note but, as we have said before, act now.”

Parliament is currently considering the Cyber Security and Resilience Bill, which will tighten the regulatory framework for sectors including energy. Ellison described the Bill as “a critical step towards managing the UK’s collective vulnerability against the backdrop of the modern threat.”

What Counts As A Severe Cyber Threat?

The NCSC guidance explains that a severe cyber threat means there is a much greater likelihood of a deliberate and highly disruptive or destructive attack against UK critical national infrastructure. These attacks go far beyond data theft or short service outages.

They may shut down critical services or operations for extended periods. They may erase or corrupt data to make recovery difficult or impossible. They may damage physical systems such as industrial control systems. The consequences can spread across industries, government and society, leading to substantial financial loss, prolonged downtime and risks to public safety and national security.

The guidance says cyber incidents targeting organisations, especially critical national infrastructure, are becoming more frequent, more sophisticated and potentially destructive. This is taking place against greater geopolitical instability and rapid technological advances. In that climate, highly capable threat actors could target UK infrastructure to cause major disruption.

Ellison wrote that the threat “is not a static component of our risk calculations” and should be monitored so operators can take informed and well planned action. He added that preparation cannot be improvised under pressure.

How Does The NCSC Want Organisations To Respond?

The NCSC sets out four activity areas to strengthen resilience. These are developing organisation wide response strategies and plans, increasing situational awareness through monitoring and intelligence sharing, hardening systems and networks to limit vulnerabilities, and ensuring the ability to maintain operations and recover during disruption.

It says organisations should already have incident response plans for events such as phishing or network compromise. Now operators must adapt those plans so they can rapidly deploy a more defensive posture if the threat escalates.

The guidance is aimed at leaders, business continuity planners, systems architects, risk managers and cyber security specialists. It says organisations must understand which systems are critical to delivering services and how systems and supply chains connect. If they do not know which systems are essential, they should define these first.

Resilience, the NCSC says, is not about eliminating all risk. That is impossible. It is about managing risk to acceptable levels and keeping systems functioning through disruption. Organisations must be ready to continue operating and carry out recovery activities under intense pressure.

Ellison wrote: “Although attacks can still happen, strong resilience and recovery plans reduce both the chances of an attack succeeding and the impact if one does.” He added that prior planning is key and that defensive actions “cannot be improvised under pressure.”

Is Encryption A Weak Link?

The NCSC warning has prompted comment from technology companies working with infrastructure operators. Michael Murphy, Deputy CTO at Arqit, said the latest version of the Cyber Assessment Framework reinforces the need for effective risk management and threat hunting.

He said outdated cryptography is a pressing risk that often goes unnoticed. “In large, complex estates, encryption is often treated as background infrastructure that is inherited through years of projects, upgrades and acquisitions. The result is that teams can be running weak TLS defaults, obsolete algorithms or brittle key management without realising. You cannot manage that risk if you cannot see it, and the last thing any organisation wants is to only see it when it is undermined.”

Murphy said a serious cryptographic audit is a critical starting point. “It gives security leaders a clear view of what protocols, cipher suites and key exchanges are actually being negotiated on live traffic, so they can prioritise reduce weak links and prove progress over time. That visibility is also the foundation for longer-term cryptoagility and post-quantum readiness.”