UK police: hackers repeatedly breached IT suppliers holding police data since 2021, HMICFRS finds
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
On 27 October 2026 His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published an inspection finding that police and fire and rescue services are not fully prepared for a growing cyber threat. The Police Digital Service and the National Police Chiefs' Council told inspectors about multiple cyberattacks since 2021 on third-party ICT suppliers that held police information. The published report removes the operational detail: it does not say how many suppliers were hit, which ones, which forces were affected, or whether data was stolen. The Police Digital Service recorded 252 cyber incidents affecting policing in January–March 2026 (malware, unauthorised access attempts, accidental disclosure by staff) and 796 near misses. Inspectors found that most supplier contracts carry no ongoing security assurance, that some staff could not say whether suppliers must report incidents promptly, and that supplier logs are usually not visible to in-house security teams. They also criticised the omission of policing and fire from the National Risk Register 2025, the January 2026 Government Cyber Action Plan and the Cyber Security and Resilience Bill. Publicly known incidents from the period include the 2023 ransomware attack on warrant-card printer Digital ID, which exposed Metropolitan Police and Greater Manchester Police staff details; the July 2026 theft of officer and staff contact details from the Police National Legal Database (PNLD), which West Yorkshire Police runs; and the September 2026 attack on Dyfed-Powys Police. The report does not say whether any of these are among the supplier cases it counts. There is nothing to patch: the fixes are supplier contracts, assurance and monitoring.
What to do
- If you supply ICT services to police or other public-safety bodies, check that your contract requires prompt incident reporting and that the customer can see your security logs
- Police and public-sector buyers: list every supplier that holds your data and write ongoing security assurance and breach-notification deadlines into each contract
- Feed supplier system logs into your own SOC, or get contractual access to them
- Assume staff identity data held by suppliers (names, photos, warrant/collar numbers, work emails) is exposed, and warn staff about targeted phishing
- Follow the Police Digital Service Third Party Assurance for Policing (TPAP) standard when onboarding suppliers
Sources
All live incidents on Threat Watch
