More than 100,000 police officers and staff have had their personal details published on the dark web after a cyberattack on the Police National Legal Database (PNLD), which provides legal guidance to forces across England and Wales.
The breach also exposed information linked to the Ministry of Defence, the Home Office, the National Crime Agency and the Crown Prosecution Service. It follows a separate cyberattack on the Department for Education, in which more than half a million records were compromised.
Leaked details
Initially assessed as relatively minor when it emerged last week, the leak has since been found to include officers' full names and contact details. These have now been made public on the dark web.
One affected official said: "I have worked in serious organised crime and put high-level criminals behind bars. For private information to be leaked about me is very disconcerting and puts officers at serious risk."
"In the past I have been forced to move into safe houses and sell cars due to my job. Now I will have to keep my wits about me online and look out for anyone trying to get more serious information. It is not a good look."
ExfilSquad suspected
The hacking group ExfilSquad is believed to be behind the attack. Citing police sources, The Times reported that data belonging to around 114,000 PNLD users was exposed, with serving officers making up the overwhelming majority of those affected.
A statement attributed to the group online read: "Once your company's data is posted here, it's NEVER leaving the public eye and it will be passed around the internet FOREVER. The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay."
Official reaction
Tiff Lynch, chairwoman of the Police Federation, said: "This reported breach raises serious concerns for officer and staff safety. At a time when cyber threats are becoming increasingly sophisticated, [the police] and its partners must be properly funded to ensure the strongest possible cyber security protections are in place to safeguard sensitive personal data."
A Government spokesperson said: "We have dedicated capabilities to respond to cyber incidents, and it would be inappropriate to comment on a live investigation."
An NCA spokesperson said: "We are aware that limited personal details relating to a number of National Crime Agency officers may have been published on the dark web as a result of the incident affecting the police national legal database."
