UK Police Data Breached Repeatedly Through Third-Party Suppliers, Watchdog Finds
A UK watchdog report reveals multiple breaches of British police data via third-party IT suppliers since 2021, highlighting systemic vulnerabilities in the supply chain for sensitive law enforcement information.
Hackers have repeatedly compromised third-party suppliers holding British police data since 2021, according to a report published Tuesday by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS). The inspectorate, which oversees policing in England and Wales and fire services in England, stated that the Police Digital Service and the National Police Chiefs’ Council shared "information on multiple cyberattacks" affecting "third-party ICT supply chains which held police information."
The report deliberately omits specific details about the number of attacks, the affected suppliers or police forces, and whether data was actually stolen, citing operational security concerns. Neither the Home Office nor the National Police Chiefs’ Council provided comment on whether police data was compromised in these supplier attacks. The watchdog did note that the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year, alongside 796 "near misses."
While the report does not specify how many of the 252 incidents involved data loss, it categorizes them as including malware attacks, unauthorized access attempts, and accidental disclosures by police staff. The HMICFRS also highlighted instances where police forces and fire and rescue services experienced cyberattacks that disrupted operational systems, compromised data, and impacted services. Leaders within these sectors reportedly informed the watchdog that "further attacks were highly likely."
The Police Digital Service, established in 2021, operates a national security operations center monitoring cyber threats across policing. It identified data held on suppliers' systems as a significant risk because it falls outside the direct monitoring capabilities of the police. This risk is particularly acute when suppliers handle sensitive information related to victims, safeguarding, intelligence, and ongoing investigations.
Inspectors found that a majority of police supplier contracts lacked ongoing cybersecurity assurance clauses. In several cases, it was unclear whether suppliers were contractually obligated to report incidents promptly. Furthermore, system logs held by suppliers were not consistently visible to in-house security teams within police organizations.
The watchdog also criticized the government for excluding policing and fire services from key national cybersecurity initiatives, such as the National Risk Register 2025, the Government Cyber Action Plan, and the Cyber Security and Resilience Bill. The HMICFRS found that no government officials could adequately explain these omissions, deeming it concerning given the critical public safety role of these sectors.
Although the report itself is vague on specifics, several public incidents align with the timeframe and nature of the findings. In 2023, a ransomware attack on ID card maker Digital ID exposed details of Metropolitan Police officers and staff, and led to the theft of names and photos of thousands of Greater Manchester Police officers. In July, the Police National Legal Database confirmed a breach that stole contact details of officers and staff, though it stated no confidential victim or offender data was compromised.
Additional incidents include a cyberattack that disrupted Dyfed-Powys Police's non-emergency systems in Wales in September, potentially compromising staff information, and a 2024 breach of Dutch police officers' contact details, which Dutch authorities attributed to a likely state actor. In the U.S., the FBI is investigating a third-party intrusion that accessed a network holding wiretap data, suspected to be carried out by China.