Hackers repeatedly breached suppliers holding UK police data, watchdog finds

Hackers have repeatedly compromised third-party suppliers holding British police data since 2021, according to a report published Tuesday by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services.

The inspectorate, which oversees policing in England and Wales and fire services in England, said the Police Digital Service and the National Police Chiefs’ Council shared “information on multiple cyberattacks” affecting “third-party ICT supply chains which held police information.”

The report does not say how many attacks took place, which suppliers or forces were affected, or whether data was stolen in these supply-chain incidents. The inspectorate said it purposefully removed operational details that it considered unsuitable for the public domain.

Neither the Home Office, Britain’s interior ministry, nor the National Police Chiefs’ Council responded to questions about whether police data was compromised in the supplier attacks.

The watchdog said the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of this year, as well as 796 “near misses,” which the report defined as incidents with no harmful breach of data or IT systems.

The report does not say how many of the 252 incidents involved data loss, nor does it break the figure down beyond saying the incidents included malware attacks, unauthorized access attempts and accidental disclosures by police staff.

Elsewhere in the report, the inspectorate said it identified “examples of police forces and fire and rescue services experiencing cyberattacks,” describing incidents that hit operational systems, compromised data and disrupted services.

Leaders in both sectors told the watchdog that “further attacks were highly likely.”

Vague insights about suppliers 

The Police Digital Service, set up by the British government in 2021, runs a national security operations center that monitors cyberthreats across policing. It warned the watchdog that police data held on suppliers’ systems was among the biggest risks the sector faces because of how that data sits outside its monitoring.

According to the report, the risk is particularly critical where suppliers handle information on victims, safeguarding, intelligence and investigations.

Inspectors found that most police supplier contracts included no ongoing cybersecurity assurance. In some cases, staff could not say whether suppliers were obliged to report incidents promptly, and in several organizations the system logs held by suppliers were not routinely visible to in-house teams.

The inspectorate also criticized the government for leaving policing and fire services out of the National Risk Register 2025, the Government Cyber Action Plan published in January and the Cyber Security and Resilience Bill, which is still going through Parliament.

Inspectors said no government official they asked could explain why the two sectors were left out of the action plan or the bill. The report called the omission concerning, given the vital role both sectors play in public safety.

Although the report does not provide detail on the breaches it counts, some incidents that took place during the timeframe given are public. In 2023, a ransomware attack on ID card maker Digital ID exposed the details of Metropolitan Police officers and staff and led to the theft of thousands of Greater Manchester Police officers’ names and photos.

In July, the Police National Legal Database, a reference service run by West Yorkshire Police and used by every force in England and Wales, confirmed that hackers had stolen the contact details of officers and staff. The service said its database held no confidential information about victims, witnesses or offenders.

Dyfed-Powys Police in Wales disclosed in September that a cyberattack disrupted some of the force’s non-emergency systems and may have compromised staff information.

Abroad, Dutch police blamed a likely state actor for a 2024 breach of officers’ contact details. In the U.S., the FBI said this year that hackers gained access through a third party to a network holding wiretap data, an intrusion investigators reportedly suspect was carried out by China.

“The cyber threat to police forces and fire and rescue services is significant and expanding rapidly,” said Michelle Skeer, His Majesty’s Inspector of Constabulary. “A major cyberattack is not a hypothetical scenario.”