Hackers have repeatedly compromised third-party suppliers holding British police data since 2021, according to a report published by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services. The report highlights multiple cyberattacks affecting the supply chains that manage police information, although it does not specify the number of attacks, the suppliers involved, or whether any data was stolen.
The Police Digital Service and the National Police Chiefs’ Council shared information on these incidents, but neither the Home Office nor the National Police Chiefs’ Council responded to inquiries regarding potential data compromises. The report indicates that the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first quarter of this year, alongside 796 “near misses,” which are defined as incidents that did not result in harmful breaches.
Concerns Over Supplier Security
The report emphasizes that police data held on suppliers’ systems represents a significant risk, particularly as this data is outside the direct monitoring of police forces. The Police Digital Service, established in 2021, operates a national security operations center to monitor cyber threats across policing. Inspectors found that many police supplier contracts lacked ongoing cybersecurity assurances, and in some cases, there was uncertainty about whether suppliers were required to report incidents promptly.
Moreover, the report criticized the government for excluding policing and fire services from the National Risk Register 2025 and the Government Cyber Action Plan, which is currently under parliamentary review. Inspectors expressed concern over this omission, given the critical role these sectors play in public safety.
Recent Cyber Incidents
While the report does not detail the breaches it references, several incidents have been publicly reported. For instance, a ransomware attack on Digital ID in 2023 exposed the details of Metropolitan Police officers and led to the theft of names and photos of thousands of Greater Manchester Police officers. Additionally, the Police National Legal Database confirmed that hackers had stolen contact details of officers and staff, although it asserted that no confidential information about victims or witnesses was compromised.
In September, Dyfed-Powys Police disclosed a cyberattack that disrupted some non-emergency systems and may have compromised staff information. Internationally, Dutch police attributed a breach of officers’ contact details to a likely state actor, while the FBI reported that hackers accessed a network holding wiretap data through a third-party vendor, with suspicions pointing to China.
Michelle Skeer, His Majesty’s Inspector of Constabulary, remarked on the escalating cyber threat to police forces and fire services, stating, “A major cyberattack is not a hypothetical scenario.” The report underscores the urgent need for enhanced cybersecurity measures within the policing sector to safeguard sensitive data.
For further details, see the full report from The Record.
