UK police data suppliers repeatedly breached by hackers since 2021, watchdog finds

Repeated Breaches Identified

A report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services revealed that third-party suppliers managing British police data have been repeatedly compromised by hackers since 2021. The Police Digital Service and the National Police Chiefs’ Council shared information on these cyberattacks affecting ICT supply chains holding police information.

Lack of Specifics on Attacks

The report did not disclose the exact number of attacks, the specific suppliers or police forces affected, or whether data was stolen. The inspectorate stated that operational details deemed unsuitable for public release were intentionally omitted. Neither the Home Office nor the National Police Chiefs’ Council commented on whether police data was compromised.

Broader Cybersecurity Incidents

Beyond supplier breaches, the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of this year, alongside 796 "near misses." These incidents included malware attacks, unauthorized access attempts, and accidental disclosures by police staff, though the report did not specify how many involved data loss.

Supplier Risk and Oversight Gaps

The Police Digital Service identified police data held on suppliers’ systems as a major risk, especially for information related to victims, safeguarding, intelligence, and investigations, due to its location outside direct monitoring. Inspectors found that most police supplier contracts lacked ongoing cybersecurity assurance, and some staff were unaware of supplier security postures.