A cyberattack on the Police National Legal Database has exposed contact details belonging to more than 100,000 UK police officers, staff members, and criminal justice professionals.
The breach was detected on 26 July. The ExfilSquad data extortion group later claimed responsibility and said it had stolen around 135,000 contact records.
PNLD has confirmed that names, organisations, and email addresses were compromised. However, it says it has found no evidence that passwords or other security credentials were affected.
PNLD breach affects police and government contacts
The Police National Legal Database is an online legal resource that has supported the 43 Home Office police forces in England and Wales for more than 30 years. British Transport Police also uses the service.
The exposed data includes contact details for police officers, police staff, criminal justice professionals, and government partners.
PNLD also runs Ask the Police, a public-facing platform that answers common questions about policing and legal matters. Names and email addresses belonging to users who submitted questions through the site were also affected.
The organisation said it does not store confidential information about victims, witnesses, or offenders. Therefore, it believes no data relating to those groups was compromised.
Authorities investigate the cyberattack
PNLD is investigating the incident with cybersecurity specialists and the National Crime Agency. It has also informed the Information Commissioner’s Office.
The service said it contacted affected organisations shortly after discovering the breach. Those organisations received further information and guidance about the incident.
PNLD has not explained how attackers gained access to its systems. It has also not publicly linked the intrusion to a specific threat actor.
ExfilSquad claims 135,000 stolen records
The ExfilSquad leak claim includes a demand for payment to prevent the release of further data. The group published sample records as alleged proof of the attack.
According to ExfilSquad, it stole 1.9GB of data from PNLD. The group claims the files contain information linked to about 114,000 PNLD subscribers and 21,000 Ask the Police users.
ExfilSquad has recently claimed responsibility for an attack on American semiconductor company Analog Devices.
PNLD has confirmed that contact information was exposed and published. However, it has not verified the group’s full claims about the amount of data taken.
The ExfilSquad leak highlights the risks that data breaches can create for public-sector staff. Even without passwords or sensitive case records, exposed names and email addresses can support phishing, impersonation, and further targeted attacks.
0 responses to “ExfilSquad Leak Exposes Data of 100,000 UK Police Staff”