> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# UK watchdog reports repeated breaches of police data held by third-party suppliers
- URL: https://f4n6.co.uk/security-feed/uk-watchdog-reports-repeated-breaches-of-police-data-held-by-third-party-suppliers/
- Published: 2026-10-27T21:17:08.000Z
- Updated: 2026-10-27T21:17:08.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a report on 27 October 2026 stating that third-party ICT suppliers holding British police data have been repeatedly compromised since 2021, based on information shared by the Police Digital Service (PDS) and the National Police Chiefs' Council (NPCC). The report gives no count of supply-chain attacks, no named suppliers or forces, and no confirmation of whether data was stolen; the inspectorate says it removed operational detail deliberately. The PDS recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 "near misses", without breaking the 252 down by data loss. No CVE, CVSS score, EPSS estimate or CISA KEV entry applies to this item; it is a governance and third-party risk finding, not a vulnerability disclosure. For EMEA financial services the direct exposure is nil, but the report documents supplier-assurance failures (contracts without ongoing cybersecurity obligations, unclear incident-reporting duties, supplier logs not visible to the buyer) that map onto the third-party oversight duties most clients already carry.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                                                                                               | Practical impact                                                                                                                                                                                                                                                                                     |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28       | HMICFRS found most police supplier contracts included no ongoing cybersecurity assurance, and in several organisations supplier-held system logs were not routinely visible to in-house teams | The same contractual and monitoring gaps are the ones Art. 28 requires clients to close for their own ICT third-party providers: verify that each contract carries security obligations that persist through the term, and that the client can obtain the provider's logs and incident notifications |
| DORA Art. 30       | Staff in some organisations could not say whether suppliers were obliged to report incidents promptly                                                                                         | Contractual provisions on incident reporting by ICT third-party providers are a named Art. 30 item; this finding is direct evidence that such clauses are often absent or unenforceable, so clients should test their own contracts against it rather than assume the clause exists                  |
| NIS2 Art. 21(2)(d) | The breaches occurred inside the ICT supply chain of the affected organisations, not in their own estates                                                                                     | Supply chain security measures are engaged for in-scope entities: the finding supports mapping supplier dependencies and requiring security commitments from them, not treating the supplier as outside scope                                                                                        |

## 3\. Technical analysis & attack chain

The report does not describe a single intrusion. It states that the PDS and NPCC shared information on multiple cyberattacks against third-party ICT supply chains that held police information, spanning 2021 to the report's publication, and that operational details were removed before publication. No attack chain can be reconstructed from the public text, and none is asserted here.

What the report does establish:

1. Multiple compromises of third-party suppliers holding police data occurred from 2021 onward, per information the PDS and NPCC gave the inspectorate.
2. The PDS recorded 252 cybersecurity incidents affecting policing in Q1 2026 and 796 near misses, the latter defined as incidents with no harmful breach of data or IT systems. The 252 are described only as including malware attacks, unauthorised access attempts and accidental disclosures by police staff; the report does not say how many involved data loss.
3. The PDS told the inspectorate that police data held on supplier systems is among the biggest risks the sector faces, because that data sits outside the PDS national security operations centre's monitoring. The risk is described as most acute where suppliers handle information on victims, safeguarding, intelligence and investigations.
4. Inspectors found most police supplier contracts contained no ongoing cybersecurity assurance; in some cases staff could not say whether suppliers were obliged to report incidents promptly; and in several organisations supplier-held system logs were not routinely visible to in-house teams.
5. Leaders in policing and fire told the inspectorate further attacks were highly likely.

The report names no supplier, no force beyond those in the separately public incidents below, no malware family, no initial-access vector, no infrastructure and no exfiltration evidence for the supply-chain attacks it counts. The Home Office and NPCC did not answer questions on whether police data was compromised.

Separately public incidents inside the report's timeframe, which the report cites as context rather than as members of the counted set:

- 2023: a ransomware attack on ID card maker Digital ID exposed details of Metropolitan Police officers and staff and led to theft of thousands of Greater Manchester Police officers' names and photographs.
- July 2026: the Police National Legal Database, run by West Yorkshire Police and used by every force in England and Wales, confirmed hackers stole contact details of officers and staff; the service said the database held no confidential information on victims, witnesses or offenders.
- September 2026: Dyfed-Powys Police disclosed a cyberattack that disrupted some non-emergency systems and may have compromised staff information.

The report also notes, outside the UK, Dutch police attributing a 2024 breach of officers' contact details to a likely state actor, and an FBI statement this year that hackers reached a network holding wiretap data through a third party, with investigators reportedly suspecting China. Neither attribution is established by the report, and neither is linked to the UK supplier breaches. No actor is attributed to any incident in this item, and no MITRE ATT&CK profile applies.

Confidence: every claim above rests on the single HMICFRS report as relayed by The Record. The underlying HMICFRS report was not reviewed directly for this advisory. Treat the incident counts and contract findings as single-sourced pending sight of the report itself.

## 4\. Mitigation & containment

This item describes no malware, infrastructure or exploited component, so there is nothing to block or isolate. The actions below address the supplier-assurance failures the report documents, applied to a client's own third-party estate.

P1 (within 24h)

- Pull the current list of ICT third-party providers that hold or can reach regulated data (customer records, transaction data, KYC files, investigation or case material) and mark which of them sit outside your own logging and monitoring. The report's central finding is that data on supplier systems escapes the buyer's SOC; identify where that is true for you.
- For each provider on that list, confirm from the signed contract whether it carries an obligation to notify you of a security incident and a stated notification window. Where staff cannot point to the clause, record the provider as unassured. This mirrors the HMICFRS finding that staff could not say whether suppliers had to report promptly.

P2 (within 72h)

- Request current evidence of the provider's security posture for the highest-risk providers: recent independent assessment or certification, confirmation that their logs for your data can be produced on request, and the named contact for incident notification. The report found supplier logs were often not visible to buyers; ask for the mechanism, not an assurance statement.
- Add a standing agenda item to the third-party risk committee covering providers that hold victim, safeguarding or investigation-type sensitive data, the categories the PDS flagged as most critical.

P3 (within 7 days)

- Amend the contract template so ongoing cybersecurity assurance and prompt incident reporting are explicit, auditable obligations rather than implied, and set a review date for existing contracts that lack them. The report found most police supplier contracts had no ongoing assurance; assume a similar tail in your own portfolio until checked.
- Where a provider cannot or will not supply logs or incident notifications, document the residual risk and the compensating control (for example, restricting the data the provider can access or requiring tokenisation of identifiers).

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The report gives no hashes, domains, IP addresses, file paths or command lines for the supply-chain attacks it counts.

The report does describe observable conditions rather than atomic indicators, so they are recorded separately below. These are not machine-pivotable and do not belong in a copyable block.

### Behavioural indicators

| Behaviour                                                                    | Where to observe                                                          | Confidence                      |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------- | ------------------------------- |
| Supplier holds police or client data outside the buyer's security monitoring | Third-party register cross-referenced against SIEM/log ingestion coverage | High (stated by PDS to HMICFRS) |
| Supplier contract contains no ongoing cybersecurity assurance clause         | Contract repository, procurement records                                  | High (inspectorate finding)     |
| Staff unable to state whether a supplier must report incidents promptly      | Supplier onboarding and contract-owner interviews                         | High (inspectorate finding)     |
| Supplier-held system logs not routinely visible to in-house teams            | Log source inventory, supplier access agreements                          | High (inspectorate finding)     |

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no malware artefacts, command lines, file names, registry keys or network values to build a YARA or Sigma rule from. Detection effort for this item belongs in supplier-assurance controls, not endpoint or network signatures.

## 7\. Sources

- The Record, "Hackers repeatedly breached suppliers holding UK police data, watchdog finds", https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report, 2026-10-27\. Single source; relays the HMICFRS report without linking to it. The HMICFRS report itself was not reviewed for this advisory.

## 8\. Adverse Trace position

This is a governance and third-party risk finding, not a vulnerability or campaign with technical indicators, and we assess it as such: no CVE, no CVSS score, no EPSS estimate and no CISA KEV entry applies, and no actor is attributed. The direct impact on EMEA financial services clients is nil; the value is as corroborated evidence, from a national inspectorate, that supplier-held sensitive data routinely sits outside the buyer's monitoring and that contracts often carry no ongoing security obligation. We treat the specific incident counts and contract findings as single-sourced to HMICFRS via The Record until the report is obtained directly, and we will not present them as multi-source corroborated. Next, we will obtain the HMICFRS report and extract any supplier categories, contract-clause findings or incident breakdowns it publishes, and we will fold the supplier-assurance checks in section 4 into the third-party risk guidance we issue to clients. Clients who want their own supplier portfolio tested against the Art. 28 and Art. 30 triggers above should contact their Adverse Trace analyst.

---

[Read the original source →](https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*