Threat intel

His Majesty's Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) published "Cybersecurity in police forces and fire and rescue services" on October 27. Inspectors found that several cyberattacks between 2021 and 2025 put police data at risk, and that in each case the company breached was an outside supplier holding police information, not a police system. The public version names none of the suppliers or forces and does not say whether data was stolen; the inspectorate removed operational detail it judged unsuitable for publication.

The report gives a sense of scale. The Police Digital Service (PDS), which runs a national security operations centre for policing, recorded 252 cybersecurity incidents and 796 near misses across policing between January and March 2026. A near miss is an event that caused no harmful breach of data or systems. Any organisation that hands case files, customer records or HR data to a provider carries the same exposure.

How supplier compromise reaches police data

A force buys a service: a case management platform, an identity card printer, a legal reference database, hosted email. To work, the supplier keeps a copy of some police data on its own systems. The force's monitoring stops at its own network edge, so a breach inside the supplier produces no alert on the force's side. The first sign is often a phone call from the supplier, a ransom note on a leak site or a journalist's question.

According to The Record, which quotes the report, PDS told inspectors that police data on suppliers' systems is among the biggest risks the sector faces, because it sits outside PDS monitoring. The risk is sharpest where suppliers hold information on victims, safeguarding, intelligence and investigations. Emergency Services Times quotes the report saying that third parties holding sensitive data about victims or investigations "creates additional cybersecurity, governance and assurance challenges."

Three further findings explain why those breaches are hard to see or contain. They come from The Record's reading of the full report, and no other outlet we found repeats them. Most police supplier contracts included no ongoing cybersecurity assurance, so a supplier checked at procurement was not checked again. In some cases staff could not say whether a supplier was obliged to report incidents promptly. And in several organisations, system logs held by suppliers were not routinely visible to in-house security teams.

So a force may learn of a supplier breach late, with no contractual lever to demand details and no way to check the supplier's logs for access to its records. One of the report's 13 recommendations, reported by both Police Professional and Rother Radio, is better procurement and contract management for third-party ICT suppliers.

Other findings make a breach harder to absorb. Every organisation inspected relied on legacy systems to some extent, and leaders rated those as their highest strategic cyber risk. Backup and restore arrangements were "unsatisfactory". Some organisations had poor controls for staff joining, moving and leaving, weak password management and patchy multi-factor authentication (MFA), and Deeside.com reports that some accounts stayed active after staff had left.

The Record also reports that the inspectorate criticised the government for leaving policing and fire out of the National Risk Register 2025, the Government Cyber Action Plan published in January, and the Cyber Security and Resilience Bill now before Parliament. We could not confirm that detail in a second source.

What attackers have done

The report lists no incidents, but several supplier and shared-service breaches since 2021 are public:

• 2023, Digital ID. A ransomware attack on this Stockport identity card maker exposed names, ranks, photos and pay numbers of Greater Manchester Police officers and staff. The Record reports that the same attack exposed details of Metropolitan Police officers and staff.
• July 2026, Police National Legal Database (PNLD). The PNLD, a legal reference service used by forces across England and Wales, confirmed that names, organisations and work email addresses of officers, staff and criminal justice partners were taken and posted online. The extortion group ExfilSquad listed it on its leak site on July 26, and the National Crime Agency is involved. PNLD says there is no evidence passwords were taken.
• September 2026, Dyfed-Powys Police. The Welsh force said an attack disrupted some non-emergency systems and may have compromised staff information. It has not said how the attackers got in.

None of these is tied to the report's anonymised cases. What they show is the typical haul: staff directories and contact data that feed targeted phishing, rather than crime systems. HM Inspector of Constabulary Michelle Skeer put it plainly: "A major cyber attack is not a hypothetical scenario."

What to do with your own suppliers

These steps follow the UK National Cyber Security Centre (NCSC) supply chain guidance and the UK General Data Protection Regulation (UK GDPR).

1. Build the inventory by data, not by spend

List every supplier that stores, processes or can reach your data, including small ones such as ID card printing, recruitment and survey tools. Record what data each holds (special category, case data, staff contacts), roughly how many records, where it is hosted and who owns the relationship. Rank by the harm if that data leaked. A low-cost card printer holding every employee's photo and staff number belongs near the top.

2. Put four clauses in every contract that touches sensitive data

• An incident notification window in hours, measured from the supplier's detection. Under UK GDPR Article 33(2) a processor must notify the controller "without undue delay"; write a number such as 24 hours, because you have 72 hours from awareness to report to the Information Commissioner's Office (ICO).
• Access to logs for your tenant or your records: authentication events, admin actions and bulk exports, delivered on request within a set time and kept for a stated period (12 months is a reasonable floor).
• A right to audit, or to receive independent audit reports, at least annually and after any incident.
• Return and deletion of data at contract end, with a signed certificate, covering backups and sub-processors.

3. Ask for assurance evidence and read its scope

A Cyber Essentials Plus certificate or an ISO/IEC 27001 certificate means little if the system holding your data is outside its scope. Ask for the Cyber Essentials Plus scope statement and the ISO 27001 Statement of Applicability, and check that the named platform, hosting and support team are in them. Diarise expiry dates and ask again at renewal: that is the ongoing assurance inspectors found missing.

4. Shrink what suppliers hold

Send the minimum fields each service needs. A legal reference database does not need staff home addresses; a printer can receive a photo and staff number for a batch and delete them after printing. Remove supplier accounts and API keys when a project ends, and include supplier-facing accounts in your leaver process, since inspectors found leavers' accounts left active.

5. Prepare for the call

Write the playbook before you need it, with names against each step. Rotate anything the supplier could have used to reach you, including single sign-on (SSO) app secrets, API tokens and VPN accounts, before the supplier finishes its investigation. And assume leaked staff contact lists will be used for phishing that cites the breach itself, so warn staff the same day.

What is not yet known

The public report names no suppliers and gives no count of supplier breaches. We could not retrieve the full text directly, so the contract, notification and log findings rest on The Record's reporting.

Our compliance and audit readiness work builds supplier clauses and evidence checks like these into procurement and renewals, and security operations can bring supplier logs into your monitoring. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: HMICFRS report page, The Record, Police Professional, Emergency Services Times, Deeside.com, Rother Radio, Police Digital Service statement, TechCrunch on Digital ID, Security Affairs on PNLD, The Record on Dyfed-Powys Police, NCSC supply chain security guidance, UK GDPR Article 33, ICO personal data breach guidance.