UK Police Data Breached via Suppliers, Watchdog Warns

Police forces spend heavily on securing their own networks. The problem, according to a new inspection, is that a lot of police data no longer lives there.

His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) found that hackers have repeatedly compromised third party suppliers holding British police data since 2021, The Record reported on October 27, 2026. Most of those supplier contracts carried no ongoing cybersecurity assurance at all.

Key Takeaways

• HMICFRS says hackers have repeatedly compromised third party ICT suppliers holding UK police information since 2021, but its public report does not name the suppliers or forces, or say whether data was stolen.
• The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year, plus 796 near misses.
• Most police supplier contracts included no ongoing cybersecurity assurance, and supplier system logs were often not visible to in-house security teams.
• Policing and fire services were left out of the National Risk Register 2025 and the Cyber Security and Resilience Bill, and no official could explain why.

Which Watchdog Published the Findings?

The findings come from HMICFRS, the inspectorate that oversees policing in England and Wales and fire services in England, not from the Information Commissioner's Office. The inspectorate announced the report under the headline that police and fire and rescue services are not fully prepared for a growing cyberattack threat.

This was a planned thematic inspection. Michelle Skeer proposed adding cyber security to the 2025 to 2027 inspection programme back in 2024, and a North Yorkshire committee paper records that fieldwork took place in January 2026. Skeer, quoted by The Record as His Majesty's Inspector of Constabulary, put it bluntly: "A major cyberattack is not a hypothetical scenario."

What Did the Report Find About Suppliers?

The report found that police data held by outside companies is attacked repeatedly and watched poorly. The inspectorate said it had been given "information on multiple cyberattacks" on "third party ICT supply chains which held police information," according to The Record. The specific weaknesses:

• No ongoing assurance. Most police supplier contracts included no ongoing cybersecurity assurance. A supplier could pass procurement and never be checked again.
• Unclear reporting duties. In some cases staff could not say whether a supplier was obliged to report an incident promptly.
• Blind spots in monitoring. In several organisations, system logs held by suppliers were not routinely visible to in-house teams.
• Outside the national SOC. The Police Digital Service, which runs a national security operations centre, called police data on supplier systems one of the sector's biggest risks because it sits beyond its monitoring.

What the report does not contain matters as much. It does not count the supplier attacks, name the suppliers or forces, or confirm whether data left the building. The inspectorate removed operational details it judged unsuitable for publication.

How Many Incidents Hit UK Policing?

The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year, covering malware, unauthorised access attempts and accidental disclosures by staff. It also logged 796 near misses, meaning events with no harmful breach of data or IT systems. The report does not say how many of the 252 involved data loss.

Put those figures on a daily scale and they read differently. 252 incidents over roughly 90 days is close to three a day; adding the near misses brings it to about 1,048 events, or more than eleven every day. That is the baseline for forces whose own networks are monitored. Supplier systems, by the Police Digital Service's own account, are not in that count's line of sight.

Which Supplier Incidents Are Already Public?

Several police data incidents involving outside providers are already on the record, though the inspectorate did not link them to its findings:

• Digital ID, 2023. A ransomware attack on the ID card maker exposed details of Metropolitan Police officers and staff, and thousands of Greater Manchester Police officers' names and photos were stolen.
• Police National Legal Database, July. Hackers stole officer and staff contact details from this reference service run by West Yorkshire Police and used by every force in England and Wales. The service said it held no confidential information on victims, witnesses or offenders.
• Dyfed-Powys Police, September. A cyberattack disrupted some non emergency systems and may have compromised staff information.

The question many readers will ask is whether informant or witness files were exposed. Nothing public says so. What the inspectorate does say is that victim, safeguarding, intelligence and investigation information is the category it treats as especially critical, and that category is exactly what case management and evidence suppliers handle.

The Compliance Angle: Third Party Risk Without a Register

Most coverage will focus on the 252 incidents. The sharper finding for compliance teams is the policy gap. Policing and fire were left out of the National Risk Register 2025, the Government Cyber Action Plan published in January, and the Cyber Security and Resilience Bill still before Parliament. No official the inspectors asked could explain the omission, which the report called concerning.

That leaves contracts as the main control, and the report says most contracts do not include ongoing checks. Under UK data protection law, a force remains the controller when a processor holds its data, and the ICO guidance on controllers and processors expects contracts to require processors to help with security and breach notification. A contract where staff cannot say whether prompt reporting is required fails that test on its face. This is the same pattern seen in the US Bank LockBit fourth party breach: the organisation customers trust is rarely the one that gets hit.

Why This Matters for Journalists, Sources and Witnesses

For anyone who has given information to police, the risk sits with whoever stores it, and that is increasingly a contractor. A reporter protecting a source, or a witness in a sensitive case, has no way to see which suppliers hold their statement or whether those suppliers are monitored.

The Toronto Crime Stoppers tip breach showed how an anonymity promise can fail at the vendor layer. Practical steps for high risk people:

• Ask the investigating officer how statements are stored and who can access them, and request anonymity measures early where they apply.
• Share only what the case needs. Details you never hand over cannot leak from a supplier.
• Keep sensitive source contact on end to end encrypted channels rather than ordinary email or SMS.

What This Means for Your Inbox

The report has no email specific incident. The email risk is downstream. Several public police supplier breaches exposed officer and staff contact details, and stolen contact lists are raw material for convincing impersonation.

If you receive an unexpected message claiming to come from a named officer, asking you to confirm details, open an attachment or call a new number, verify it through 101 or the force's published contact page, not through the details in the message. Action Fraud is the reporting route for police impersonation scams in England and Wales. Organisations should assume staff directories are already partly public and train people accordingly; the Stripe vendor leak of 1,033 API keys is another reminder that supplier exposures surface long after the fact.

What Should Organisations Do Now?

Organisations should treat suppliers as part of their own attack surface and check them continuously, not once. The NCSC supply chain security guidance is the obvious starting point. A short checklist drawn from the report's weaknesses:

• Map the data. List every supplier holding personal data and what category: victims, witnesses, staff, intelligence.
• Write in notification deadlines. Every processor contract should state how fast incidents must be reported, and staff should know the answer.
• Get the logs. Require supplier security logs to flow into your own monitoring, or at least be available on demand.
• Assure annually. Repeat security reviews during the contract, not just at procurement.
• Minimise. Send suppliers the least data they need, pseudonymise where possible, and enforce deletion at contract end.

Looking Ahead

Leaders in both sectors told inspectors that further attacks were highly likely. The next signal to watch is whether the Cyber Security and Resilience Bill is amended to cover policing before it passes, and whether forces publish how many supplier contracts now include ongoing assurance. Until then, the safest assumption for anyone sharing information with police is that it may sit on a system nobody in the force is watching. The full details are in the HMICFRS announcement.

Even the UK's signals intelligence agency has lost track of data: GCHQ cannot account for thousands of storage devices.