UK POLICE DATABASE BREACH EXPOSES DATA OF 100,000+ STAFF

The Police National Legal Database (PNLD) confirmed a data breach affecting more than 100,000 criminal justice professionals after the threat group ExfilSquad published stolen records on the dark web. The incident occurred over a weekend in July, with PNLD discovering the breach on 26 July. Names, organisations and work email addresses of police officers, police staff, criminal justice professionals, government partners and customers were taken. PNLD stated there is "no evidence" that passwords or other security credentials were compromised, though the method of attack remains undisclosed.

ExfilSquad claimed responsibility for the attack and alleged it obtained 1.9 gigabytes of data containing approximately 135,000 law enforcement contact records and 21,000 records from Ask the Police, a public-facing legal advice website operated by PNLD. The threat group demanded a ransom in exchange for keeping the data secure. Following the breach, PNLD hired cybersecurity specialists and notified the National Crime Agency, which began an investigation, alongside informing the Information Commissioner's Office. West Yorkshire Police operates PNLD.

The breach appears linked to ExfilSquad's attack on the Department for Education, which confirmed last week that more than 607,000 records were exposed. ExfilSquad lists both PNLD and the Department for Education among its recent victims on its dark web leak site. All affected organisations were contacted in the days following the incident and provided with further information and guidance, according to PNLD's announcement. ExfilSquad is described as a relatively new threat actor not previously known for major attacks.