UK police legal database breach exposes details of more than 100,000 officers and staff

Contact information compromised

The contact details of more than 100,000 police officers, police staff and criminal justice professionals have been exposed following a cyberattack on a legal database used by forces across England and Wales.

The breach affected the Police National Legal Database (PNLD), an online legal reference service used for more than three decades by all 43 Home Office police forces in England and Wales, as well as the British Transport Police.

PNLD said it detected the intrusion on 26th July and has since confirmed that names, organisations and work email addresses of police officers, police staff, criminal justice professionals and government partners were accessed.

The names and emails addresses of members of the public who submitted questions through its "Ask the Police" website have also been compromised.

The agency stressed that the database does not contain confidential information about victims, witnesses or offenders, adding there was no evidence that passwords or other login credentials had been accessed.

All affected organisations have been notified, while the Information Commissioner's Office (ICO) has also been informed.

The National Crime Agency (NCA) and external cybersecurity specialists are assisting with the investigation.

One police staff member whose details were exposed told The Times that the leak was deeply unsettling because of their work targeting serious organised crime.

Hackers claim larger haul

Responsibility for the attack has been claimed by the data extortion group ExfilSquad, which says it stole around 1.9GB of information containing approximately 135,000 records.

According to the group's claims, the stolen data includes details linked to about 114,000 PNLD subscribers and 21,000 users of the Ask the Police service.

The hackers have published a sample of the data online and are demanding a ransom to prevent the remainder being released.

PNLD has acknowledged that contact information was published online but has not publicly attributed the attack or disclosed how the attackers gained access to its systems.

ExfilSquad has previously claimed responsibility for cyberattacks against other organisations, including US semiconductor manufacturer Analog Devices.

Concerns over public sector cybersecurity

The incident has raised fresh concerns about the security of UK public sector IT systems after a series of recent breaches affecting government organisations.

The breach comes only days after hackers targeted the Department for Education, where more than half a million records were exposed in a separate cyberattack also claimed by ExfilSquad.

UK Government Investments (UKGI), the body responsible for overseeing billions of pounds in government-owned assets, has also revealed a data breach that exposed sensitive internal information and the work contact details of dozens of government officials online for nearly 48 hours.

Commenting on PNLD breach, Graham Taylor, Director of Defence Strategy for Northern Europe at cybersecurity company OPSWAT, said the immediate priority should be protecting officers whose identities had been exposed, particularly those involved in organised crime investigations.

While ExfilSquad appeared to be financially motivated rather than state-backed, Taylor said the attack highlighted wider challenges facing the public sector.

"The uncomfortable truth is that much of the UK's public sector, with significant legacy systems and fragmented oversight, is years behind the resourcing and resilience needed to combat current and future cyber threats."

"Departments need to implement secure file transfer technologies, alongside file inspection and malware scanning, to stop malicious payloads entering critical systems via trusted data exchanges," he noted.