UK expands National Risk Register with new cyber threat scenarios

Government urges public to prepare as risks rise

The government has expanded its National Risk Register to include a series of new cybersecurity scenarios, warning that such attacks could have severe consequences for public safety and the economy.

The updated National Risk Register sets out a series of cyberattack scenarios and the potential impact on critical digital systems, water infrastructure and policing networks.

Earlier this year, ministers were warned that Britain's supply chains remained vulnerable to major national shocks, with an independent preparedness review arguing that the UK was falling behind several European countries in contingency planning and stockpiling essential supplies.

The updated register [pdf], published on 14 July, introduces seven new risks, several of them linked to cyber threats.

The National Risk Register is the government's public assessment of the most significant risks facing the country. Officials stress that it is intended as a planning tool to help organisations prepare for emergencies rather than a prediction of future events.

Critical infrastructure under the spotlight

Among the newly added scenarios is the possibility of a sophisticated cyberattack targeting one or more UK colocation datacentres.

The government warns such an incident could result in the theft of sensitive customer data, intellectual property and operational information, while recovery could take days or weeks and restoring compromised information could take years.

Although the likelihood of such an attack is assessed as between 5% and 25%, the register says the consequences could include up to 200 fatalities, hundreds of casualties and economic losses running into hundreds of millions of pounds.

The updated assessment also examines the impact of cyberattacks on water companies.

It envisages a malicious actor infiltrating operational technology systems and deploying destructive malware, leaving operators unable to monitor or control essential services. Such an attack could disrupt water supplies and wastewater treatment for months, with knock-on effects for public health.

Another scenario focuses on policing infrastructure, warning that cyberattacks could compromise investigations, disrupt access to intelligence, endanger officers and reduce the effectiveness of frontline policing for extended periods.

The register also includes the prospect of a widespread digital outage, similar to CrowdStrike disruption caused by a faulty software update.

Officials say such an event could simultaneously affect communications networks, emergency services, transport, border controls, financial systems, broadcasting and millions of connected devices.

Concerns over democracy and AI

For the first time, the National Risk Register includes a dedicated section on threats to democratic processes.

The government says potential risks include attacks on election infrastructure, online disinformation, harassment of candidates and voters, the leaking of politically sensitive information and foreign interference aimed at influencing democratic institutions.

Public urged to prepare for emergencies

Current Chancellor of the Duchy of Lancaster and Chief Secretary to the Prime Minister Darren Jones said the updated register reflects the changing nature of national risks and the country's increasing dependence on digital and operational technology.

"The government will do all it can and we are well prepared - but we can all play our part to keep ourselves and our loved ones safe," he said.

Alongside the revised register, the government said it will launch a nationwide resilience campaign later this year aimed at helping households strengthen their preparedness for emergencies such as cyberattacks.

The initiative will expand existing guidance available through GOV.UK, provide new educational resources for schools and colleges, and bring the UK closer to several European countries that already run national preparedness campaigns.

The government is also considering changes to strengthen the role of regional mayors in local emergency planning as part of a wider consultation on the Civil Contingencies Act 2004.