A major database containing the work details of British police officers and criminal justice professionals has been compromised, it has emerged.
The Police National Legal Database (PNLD) is managed by the West Yorkshire Police and contains information on officers from all 43 police forces in England and Wales, as well as the British Transport Police, the Crown Prosecution Service, the Independent Office for Police Conduct, and His Majesty’s Courts and Tribunals Service.
An August 3 statement from the PNLD revealed the service had suffered a “data security incident,” which was identified on July 26.
“Information including the names, organizations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web. There is no evidence to suggest that passwords or other security credentials have been compromised,” it explained.
“Since the incident was identified, we have been working with specialist cybersecurity organizations and the National Crime Agency to investigate the circumstances and take appropriate action.”
Read more on police data breaches: PSNI Faces £750,000 Data Breach Fine After Spreadsheet Leak
Also impacted was the Ask the Police service operated by the PNLD.
“As a result, some names and email addresses of people who have previously submitted a question to Ask the Police have been published on the dark web,” the notice read.
“If you have been affected, you will have already received an email from Ask the Police with more information and guidance.”
The PNLD explained that it doesn’t hold any confidential information relating to victims, witnesses, or offenders.
ExfilSquad Claims Responsibility for PNLD Hack
ExfilSquad, the extortion group responsible for a recent data breach at the UK’s Department for Education, claimed it was also behind the PNLD incident.
According to screenshots of its leak site posted to X, the group claimed to have 1.9GB of data in its possession, including 135,000 records, some of which it leaked to prove it means business.
“Once your company’s data is posted here it’s never leaving the public eye and will be passed around the internet forever,” a note by the group read. “The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay.”
For PNLD to pay is highly unlikely given the UK government’s intention to introduce a de facto ban on public sector organizations paying extortion demands made by cyber adversaries.
Any individuals named in the breach ought to be on the lookout for follow-on attacks if their data is leaked.
Dray Agha, senior manager, security operations center EMEA at Huntress, said: “While the absence of compromised passwords is a relief, exposing the names and work emails of UK police and justice staff on the dark web hands cybercriminals a readymade directory to launch highly targeted spear-phishing and social engineering attacks against the very people defending our justice system.”
