UK police legal database breach exposes officer details, increasing phishing risks

Based on information from Security Affairs, a significant data breach has compromised the Police National Legal Database (PNLD) in the UK, exposing the personal and work contact details of police officers, staff, and criminal justice professionals. The compromised information was subsequently published on the dark web, raising concerns about increased phishing and targeted attacks.

The breach affected the PNLD, a legal reference system used by all 43 Home Office police forces in England and Wales, as well as the public Q&A service "Ask the Police." Exposed data includes names, organizations, and work email addresses. While passwords were not compromised, the leaked information makes officers and staff more vulnerable to sophisticated phishing attempts. The National Crime Agency is investigating the incident, with cybersecurity firms suggesting a potential link to misconfigured Microsoft Power Pages portals, a vulnerability that could allow anonymous users to access data.

The PNLD hosts legal information and services but is not a crime recording system. Affected organizations have been notified, and the incident reported to the UK Information Commissioner's Office. The extortion group ExfilSquad has been linked to similar attacks, though attribution for this specific breach is not yet confirmed.

Source: Security Affairs