The Record

Britain faces the “real prospect of an unprecedented rise in the number of cyber incidents” in the coming months, the head of the country’s National Cyber Security Centre (NCSC) will warn Tuesday.

Launching the agency’s annual report, NCSC Chief Executive Richard Horne will warn that the risk is “not because AI has invented new ways to attack us,” but “because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

The warning follows an alert issued in June by the Five Eyes intelligence alliance, which said AI would fundamentally transform both offensive and defensive cyber capabilities. “The timeline is not years, it is months,” it said at the time.

Officials point to the surging levels of vulnerabilities being uncovered by vendors as evidence this transformation is underway. They warn the change is accelerating, even if experts have not yet observed a corresponding rise in exploitation.

“Major technology providers are now fixing hundreds of vulnerabilities in a single update … and the Linux kernel project alone patched more than a thousand vulnerabilities last month,” Horne will say, adding that AI “is enabling vulnerabilities to be found and fixed faster than ever.”

The risk from attackers deploying the technology remains significant. The NCSC will say it was “highly likely” that AI-powered malware would be used in a ransomware attack on Britain’s critical infrastructure by 2028, and warned that China and Russia will “routinely” be using AI in their cyber operations by that date.

The annual report stresses that AI “did not create these cybersecurity weaknesses,” but is instead exposing “years of technical debt and the failure to implement even basic cyber protections.”

The NCSC will say even hacks linked to state-sponsored actors were often conducted through internet-facing applications and by exploiting “vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion.”

Speaking in the wake of the British government’s official budget, which revealed plans to consult on whether to hold technology companies liable for cyber breaches caused by insecure products, Horne will take aim at how existing business practices have led to the current status of widespread vulnerability.

“For decades, we have collectively got away with doing tech on the cheap,” he will say, referencing organizations keeping end-of-life systems running as part of their operations and delaying upgrades for “cost efficiency” reasons.

He will warn that executives who fail to act will end up having to “look their investors, shareholders, employees, customers, suppliers, in the eye and explain … when food isn’t on shelves, lights aren’t on, businesses have gone under.”

The NCSC had called publicly for a “strategic policy agenda” last year, after efforts to address insecure technology had stalled. Its chief technology officer, Ollie Whitehouse, wrote last year that “the reality is that in 2025, we know how to build secure products and services” but “the business and commercial incentives to encourage adoption and sustainment of secure solutions are not sufficient.”

AI vs AI

The threat posed by AI can be countered, Horne will say, explaining how the British government — including NCSC, a part of the cyber and signals intelligence agency GCHQ — is planning to deploy it for security purposes.

“AI has the potential to be one of the greatest opportunities in cyber defence,” he is expected to say. The report reveals the government has already begun testing frontier AI systems to identify weaknesses in its own networks.

One such initiative, titled Project DROMOS, was initially planned to be a four-week pilot before being expanded into live government environments where it found “hundreds of potential security issues, including critical vulnerabilities.”

The agency plans next to look beyond government systems with a new £70 million ($93 million) NERV Centre — the National Exposure and Real-Time Vulnerability Centre. This is intended to use AI to build on some of NCSC’s existing projects to “identify vulnerabilities across our critical infrastructure and economy.”

A further £60 million ($80 million) has been allocated to the first phase of Cyber Shield, a national network of AI agents first previewed in July that Horne is expected to say “will embed cutting-edge agentic AI into machine speed cyber defence at a national scale.”

Under the plan, the NCSC will provide the platform and threat intelligence, while security companies and open-source developers will build AI agents to operate within organizations across the country. The initial phase will focus on detecting and blocking attacks, the report will say.

In the new report, the NCSC will say it believes the “structural advantage will remain with defenders” as AI transforms cybersecurity. It is defenders who “own or operate the environment, can instrument it, can change it and can define acceptable behaviour.”

“But,” it warned, “this advantage is not a given and realising it requires clear direction, investment and disciplined adoption.”

Brazilian cryptocurrency platform Mercado Bitcoin suspended all deposits and withdrawals after a cybersecurity incident on Monday morning.

Blockchain security companies said more than $46 million left the platform late on Sunday night but Mercado Bitcoin did not confirm the figure in its statements and did not respond to requests for comment. 

In messages on social media, Mercado Bitcoin said the cyberattack did not harm customers and did not lead to a data breach. 

“Our teams are mobilized – investigating the case, tracking the assets, and coordinating measures with the competent authorities,” the company said. 

Mercado Bitcoin shared destination addresses for the stolen funds and pledged to restore the platform in the coming days. 

Tether CEO Paolo Ardoino said the platform froze about $4.5 million stolen from Mercado Bitcoin. Another $2 million worth of cryptocurrency has been frozen by other platforms.

Blockchain security company Chainalysis noted its investigators are tracking the coins so the cryptocurrency industry can “identify, freeze, and disrupt impacted funds.” 

Several blockchain security experts disputed Mercado Bitcoin’s assessment that customer funds were not accessed, showing blockchain evidence that the hackers were able to siphon funds from some customer wallets. 

Mercado Bitcoin calls itself the largest digital assets investment platform in Latin America with about 4.5 million customers. 

The attack on the company comes days after $6.3 billion was stolen from crypto platform Binance. The FBI and U.S. Secret Service blamed the incident on hackers from North Korea that have siphoned billions from crypto platforms this year. 

Multiple cryptocurrency exchanges have lost millions in cyberattacks over the last six months, with several incidents surpassing $100 million in losses. 

Even Chainalysis — which partners with law enforcement and crypto industry officials on blockchain investigations — announced a cyber incident last week where hackers used artificial intelligence-backed tools to gain unauthorized access to the company’s systems and internal tools.

The hackers stole user IDs, names, email addresses and organization role labels for users provisioned on the platform.

Users of cryptocurrency-based prediction market Polymarket will be compensated after the site was hacked last week.

In a post-mortem on the incident, Polymarket said it would give $3.9 million to those impacted by the theft — with $2.7 million used to cover the initial losses and another $1.2 million to cover losses related to the platform’s hours-long shutdown. 

“No claims or tickets needed: we identified eligible wallets from on-chain and trading data,” the company said. 

Polymarket did not respond to requests for comment about how many people were impacted by the attack.

Anyone who thinks Polymarket’s calculations are wrong were urged to reach out. As of Saturday, 95% of the affected wallets were refunded in full. 

On October 29, the company suffered outages that were eventually attributed to a compromise involving DebugBear — a company that provides website performance services.

Cybersecurity firm Hudson Rock previously said it found evidence pointing to what it called “wallet-draining code” that was designed by someone to discover accounts, select assets and transfer funds to a designated account. 

Polymarket — one of the largest prediction markets in the U.S. — confirmed that in the post-mortem. The company said an attacker replaced the performance-monitoring script loaded onto polymarket.com with another designed to steal from the site’s users. 

“For some people who had the site open during a small window … it used their active session to sell positions and move funds out of their wallet. The vendor has confirmed the compromise publicly,” Polymarket said.

The New York-based company said it removed the vendor’s compromised script, paused trading, and reset all active login sessions. 

It redeployed the vendor’s script but added “additional integrity controls and continuous monitoring and verification” that included several more security measures. 

Polymarket added that it has contacted law enforcement about the incident and is conducting its own investigation into the threat actor.

DebugBear released its own follow-up message saying it is continuing to investigate the incident but initial findings say it was compromised through its domain registrar. 

“We are currently unable to receive emails sent to our domain. Based on our initial investigation this attack targeted the website of a specific customer,” the company said. “We have not seen any indication of a compromise of our internal systems, though we will continue to investigate this.”

An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia's federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack over the weekend.

The Belarusian Cyber Partisans and the pro-Ukrainian hacking group Silent Crow said Sunday they spent months inside Rosstat's network before launching a destructive operation that wiped servers and disrupted the agency's systems.

Rosstat confirmed that it had been targeted by a cyberattack but disputed the hackers' claims about the extent of the breach, saying it had found no evidence that protected information had been leaked or its databases compromised.

In a statement to Russian state news agency TASS, Rosstat said its security systems had detected suspicious activity in time for specialists to respond. The agency said it was working with cybersecurity experts and law enforcement to identify the source of the attacks.

Rosstat, which collects and publishes official statistics on Russia's population, economy and social conditions, holds extensive government data, including demographic records and information from Russian-occupied Ukrainian territories.

According to the Cyber Partisans, the hackers first gained access to Rosstat's network about six months ago and spent the following four months quietly moving through its systems, collecting internal documents and expanding their access.

"We reached the agency's critical systems while systematically extracting sensitive data and internal documents," the group claimed.

The hackers said they began preparing for the destructive phase of the operation about a month ago, with the most intensive activity taking place over the past two weeks.

The attack culminated overnight on Saturday, they said, with the destruction of physical and virtual servers, along with large-scale data storage systems.

Silent Crow claimed the operation gave the hackers access to approximately 25,000 computers and other devices across Rosstat's headquarters, regional offices and main statistical data processing center.

The group purported to have compromised systems used to manage the agency's network, including domain controllers, virtualization platforms and infrastructure management tools. The hackers also said they breached databases containing economic, demographic and personal information, census records and internal government correspondence.

Among the allegedly stolen material were confidential mortality records detailing causes of death in Russia, as well as nonpublic statistics from Russian-occupied Ukrainian territories. The groups also claimed to have obtained information about Russian military casualties in the war against Ukraine.

The hackers' claims about the scale of the breach, the destruction of infrastructure and the theft of sensitive data could not be independently verified. The Cyber Partisans said they planned to release a detailed account of the operation, along with samples of the allegedly stolen data, in the coming days.

The groups also claimed to have replaced content on Rosstat's servers with official Ukrainian statistics on Russian military losses. They said the information remained publicly accessible for about an hour before the agency's systems began experiencing disruptions.

Russian newspaper Kommersant reported that hackers had defaced Rosstat's main website and regional portals, leaving messages that included a warning in Belarusian: "No one will escape accountability."

A familiar alliance

This was not the first time the two hacking groups have joined forces to target major Russian organizations.

In July 2025, the Cyber Partisans and Silent Crow claimed responsibility for a disruptive cyberattack on Aeroflot, Russia's flagship airline, which forced the carrier to cancel more than 100 flights and affected roughly 20,000 passengers.

The hackers claimed to have destroyed parts of the airline's IT infrastructure and stolen sensitive information, including flight records, internal communications and employee monitoring data. They later published what they said were flight records belonging to Aeroflot's chief executive.

The Cyber Partisans said Rosstat had proven to be a more difficult target than the airline.

"Unlike Aeroflot, which we attacked in 2025, Rosstat had a more robust security system," the group said.

The Belarusian Cyber Partisans emerged following mass protests against President Alexander Lukashenko in 2020, after an election widely condemned by Western governments as fraudulent. The group has since carried out cyber operations targeting Belarusian and Russian government institutions.

In October, the group disclosed that it had infiltrated Moscow's healthcare network in 2023, claiming to have gained administrator-level access to systems connected to other government agencies.

Silent Crow has also claimed responsibility for attacks on Russian government agencies and businesses, including an earlier breach of Rosreestr, the country's state property registry.

In July, Russia's Supreme Court designated both hacking groups as extremist organizations, effectively outlawing their activities in the country and exposing individuals associated with them to potential criminal prosecution. The practical consequences of the designation remain unclear, as the hackers have continued targeting Russian organizations.

"It looks like Rosstat will have to recalculate not only its statistics this time, but also the scale of its own problems," Silent Crow said.