UK Police Data Repeatedly Exposed Through Supplier Breaches, Watchdog Warns

Hackers have repeatedly compromised third-party suppliers that hold British police data since 2021, according to a report from His Majesty's Inspectorate of Constabulary and Fire & Rescue Services. The Police Digital Service and the National Police Chiefs' Council shared information on multiple attacks affecting supply chains that held police information. The report does not say how many attacks occurred, which suppliers or forces were affected, or whether data was stolen. The inspectorate said it removed operational details it considered unsuitable for the public domain, and neither the Home Office nor the National Police Chiefs' Council answered questions about whether data was compromised.

The report also gives a sense of the wider pressure. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of this year, plus 796 near misses, meaning incidents with no harmful breach of data or IT systems. The incidents included malware attacks, unauthorised access attempts and accidental disclosures by police staff. The report does not say how many involved data loss. Leaders in policing and fire services told the watchdog that further attacks were highly likely.

The Police Digital Service warned that police data held on suppliers' systems is among the biggest risks the sector faces, because that data sits outside its monitoring. The report says the risk is particularly critical where suppliers handle information on victims, safeguarding, intelligence and investigations.