How To Prepare For A Cyber Attack (Without Buying A Bunker Or Panicking)

On 3 November, the National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report. The line everyone picked up on: it is “highly likely” that AI-powered malware will be used in a ransomware attack on the UK’s critical national infrastructure by 2028.

NCSC’s chief executive Dr Richard Horne also warned that “in the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” and offered a fairly withering diagnosis of how we got here: “For decades, we have collectively got away with doing tech on the cheap.”

Two weeks earlier, on 22 October, the Cabinet Office launched Be Ready, a three-year campaign asking every UK household to keep enough supplies to manage for three days if everyday services go down. “From severe weather to cyber attacks, emergencies can disrupt the services you rely on.” Then on 7 November the BBC revealed its “Black Sky” contingency plan: an emergency radio studio, staffed by around 100 people, with enough food, water and fuel to broadcast for three days if the power, internet and mobile networks all fail at once.

So no, the government has not told us an attack is imminent but it has told us an attack is likely at some point… scroll on to find out how to prepare for one.

The Supermarket Freezer Thing Is Real (But Not Here)

You may have heard that hackers switched off supermarket freezers. They did. On 12 October, attackers remotely connected to the refrigeration controllers in around 700 French food stores, including Intermarché and Coopérative U branches, and switched them into defrost mode. Staff arrived to pools of water and bins full of spoiled stock. Then, overnight on 1-2 November, it happened again across seven countries: Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden.

In Stockholm, Engla Ingwall, sales manager at an ICA store, told Reuters: “There has been a cyberattack and all our freezers reached 50 degrees.” In Ireland, Musgrave confirmed a cyber incident at 13 SuperValu stores and said: “The incident is limited to a specific model of refrigeration. Our monitoring systems alerted us to the issue, and we took immediate action.” Chilled and frozen food was pulled from sale as a precaution, and all 13 stores were trading normally again within a day.

No UK supermarket has been affected. But British retailers have been put on alert, and the NCSC says it is working with industry and international partners. Why does a fridge get hacked? Because modern supermarket refrigeration is run by controllers that connect to the internet so maintenance firms can adjust temperatures remotely.

It’s worth remembering that the UK has already had its practice run. In spring 2025, the attacks on M&S, Co-op and Harrods left Co-op shelves empty in some stores, took M&S online orders down for weeks and exposed the personal data of millions of members. More recently, in October, ASOS confirmed that an attacker had impersonated a trusted contact to steal an employee’s login details and access customer names and contact details.

Why we care: none of this is about hackers coming for you personally. It’s about the systems you lean on every day (your bank app, your supermarket, your phone signal) all having an off day at the same time.

Part One: Your Digital Life (Do This Tonight)

The NCSC’s Cyber Aware advice for individuals is refreshingly short:

1. Give your email a password it doesn’t share with anyone

Your email is the master key. Reset any other password and where does the link go? Exactly. The NCSC’s recommendation is three random words (think CoffeeTulipPiano, not your dog’s name plus 123), long enough and strong enough, and different from every other password you own.

2. Turn on 2-step verification

Also called two-factor authentication or 2FA. It means that even if someone has your password, they still can’t get in without the code on your phone. The NCSC says to switch it on for your most important accounts: email, banking, social media and online shopping. It takes a few minutes per account and lives in the security settings. Use an authenticator app (Google or Microsoft’s are free) rather than text messages where you’re given the choice.

3. Let your devices update themselves

Those “install tonight” prompts you keep swiping away? They are mostly security patches. Turn on automatic updates on your phone, laptop and browser and stop having the argument.

4. Back up the things you’d cry about

Photos, documents, the Notes app novel. iCloud, Google One or an external drive, whichever you’ll actually use. If your phone is lost, wiped or held to ransom, a backup turns a disaster into an inconvenience.

5. Get a password manager

The NCSC is fine with you saving passwords in your browser, and even happier if you use a dedicated manager. It is the only realistic way to have a different strong password for everything without a notebook.

6. Know what a breach notification looks like

After the ASOS incident, the NCSC’s advice was to look out for suspicious messages, which “can arrive some time after a data breach incident.” Scammers buy stolen contact lists and then phone or text you pretending to be the company that lost them. If a message creates urgency (“your account will be closed”, “confirm your details now”), that is the tell. Forward dodgy texts to 7726, dodgy emails to report@phishing.gov.uk, and report fraud to Action Fraud.

Part Two: Your Actual Home (Do This At The Weekend)

This is the ‘Be Ready’ checklist, which the government organises into nine categories. Three days is the magic number because, in the Cabinet Office’s words, “being ready for 3 days helps you manage while support reaches those in need.”

• Water: three litres per person per day for drinking, so nine litres each for three days. More if you want to cook, wash or have a baby or a pet.
• Food: three days of things that don’t need a fridge or a hob. Tins, crackers, nut butter, long-life milk, the granola. A tin opener that isn’t electric.
• Light and warmth: a torch for everyone (a head torch leaves your hands free) plus spare batteries, blankets and warm layers. Candles are the romantic option but its a fire-risk option.
• Communications: a battery or wind-up radio. If the internet and mobile networks go, FM radio is how the BBC’s Black Sky plan reaches you. Also a charged power bank for your phone, and the important numbers written down on paper.
• Money and documents: some cash in small notes, because card machines and cash points run on electricity and connectivity. Copies of key documents, and know where the originals are.
• Medicines and first aid: a week’s buffer on prescriptions if you can, plus a basic first aid kit.
• Baby and pet supplies: three days of food, water and anything else they rely on.

Two free extras worth doing. First, save 105 in your phone: it’s the number for power cuts in England, Scotland and Wales. Second, check whether you or a relative qualifies for the Priority Services Register, which gets vulnerable households extra help from energy and water companies during outages, including advance notice of planned power cuts. Lots of people are eligible, including households with children under five.

Part Three: The Bits Nobody Mentions

Your fridge rules still apply. If the power goes for more than four hours, be suspicious of anything chilled. Keep the door shut and it will hold for a while; a freezer holds longer if it’s full.

Your landline may not work. Many UK landlines now run over broadband, which means no power, no phone. In a life-threatening emergency, try 999 from a mobile: emergency calls automatically roam onto any available network.

Pay attention to your bank’s downtime. Keep a second way to pay (a different card, a different bank, cash) so one app having a wobble doesn’t leave you stranded at the till.

Start planning. Within days of the Be Ready launch, torches and wind-up radios sold out at several retailers.

A Note On The AI Of It All

AI is on both sides of this. The NCSC’s point is not that AI has invented new ways to attack, but that it lets attackers find and exploit the old, boring weaknesses (unpatched software, exposed logins, people who click) at a speed and scale we haven’t seen before.

The same report calls AI a “critical opportunity” to improve our collective defences, and the government has put £60 million into a national Cyber Shield that uses agentic AI to spot and respond to attacks, plus £70 million into a new vulnerability centre. Which is a useful reminder that the fix for most of this is not fear, it’s maintenance.

Defence Secretary Wes Streeting said he wanted people to be “alert but not alarmed.” Do the six digital things tonight. Buy the water at the weekend. Then relax.