West Yorkshire Police has notified the Information Commissioner's Office after a data security incident at the Police National Legal Database (PNLD) resulted in the names, organisations and work email addresses of police officers, staff and other criminal justice professionals being compromised and published on the dark web.
The PNLD is a legal reference service operated by West Yorkshire Police and used by all 43 Home Office police forces in England and Wales as well as the British Transport Police. On its website (https://www.pnld.co.uk/article/?id=7ebf3c0e-598e-f111-8077-7ced8d3aa78f) West Yorkshire Police said the incident was identified on Sunday 26 July and that the compromised data also included details of government partners and customers.
There was no evidence, it said, that passwords or other security credentials had been affected, and that it had been working with specialist cyber-security organisations and the National Crime Agency since the incident was identified. All affected organisations were contacted in the days following the incident and provided with further information and guidance, it said.
The breach also extends to data belonging to members of the public. Ask the Police, the public-facing question-and-answer service hosted on the PNLD platform, confirmed that some names and email addresses of people who had previously submitted questions to the service had been published on the dark web, and said affected individuals had been emailed directly with information and guidance.
The PNLD emphasised that it is a legal information service rather than a crime recording system, and does not hold confidential information relating to victims, witnesses or offenders.
The organisation has not said how the attackers gained access, when the data was taken or how many individuals are affected. However, a data extortion group calling itself ExfilSquad has claimed responsibility, listing the PNLD on its dark web leak site alongside a claimed 1.9GB dataset of roughly 135,000 law enforcement contact records, according to reporting by The Register and BleepingComputer.
The same group claimed a recent breach at the Department for Education, which subsequently confirmed that more than 607,000 records containing customer service contact details had been exposed. None of the figures claimed for the PNLD dataset have been confirmed.
Although the exposed data is largely limited to work contact details, the publication of a consolidated list identifying serving police officers and their force affiliations raises risks beyond those of an ordinary contact-data breach. Tiff Lynch, chair of the Police Federation of England and Wales, said the reported breach raised serious concerns for the safety of officers and staff.
