Ethical Hacking News
The Police National Legal Database (PNLD) has confirmed a data breach exposing contact details of police officers, staff, and criminal justice professionals on the dark web. The investigation by the National Crime Agency and cybersecurity firms is ongoing, with concerns about the security of the PNLD and its vulnerability to cyber attacks.
The UK police legal database breach has exposed contact details of police officers, staff, and criminal justice professionals. The breach also affected a public Q&A service called Ask the Police. The exact number of individuals in the breached dataset is unknown, as well as the timeline of when the intrusion began or how much data was taken. The breach primarily affected the Police National Legal Database (PNLD) and its hosted site, Ask the Police. A cyber attack involving misconfigured Microsoft Power Pages portals may be to blame for the breach. Robust cybersecurity measures are necessary for organizations handling sensitive data.
The UK police legal database breach has exposed the contact details of police officers, staff, and criminal justice professionals, as well as published them on the dark web. The Police National Legal Database (PNLD) confirmed the data breach, stating that information including names, organizations, and work email addresses of affected individuals had been compromised and made public.
The breach also hit Ask the Police, a public Q&A service hosted on the same platform. The National Crime Agency is involved in the investigation, with police officers and staff being advised to be vigilant for targeted phishing attacks using their name, organization, and work email address.
PNLD reported 108,429 police registrations in its 2025-26 annual summary, which provides some insight into the potential user base affected. However, the exact number of individuals in the breached dataset remains unknown, as does the timeline of when the intrusion began or how much data was taken.
The breach primarily affected the PNLD, which hosts Ask the Police site. As a result, names and email addresses of people who had previously submitted questions to Ask the Police have been published on the dark web. This exposure creates two distinct risk categories: named officers are now more vulnerable to targeted phishing, while members of the public who contacted police services have had their fact made visible on criminal forums.
PNLD also provides legal information, products, and services to UK police forces and criminal justice organizations; it is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders. All affected organizations were promptly notified, provided guidance, and the incident was reported to the UK Information Commissioner's Office (ICO).
The incident has raised concerns about the security of the PNLD and its vulnerability to cyber attacks. Cybersecurity firm VenariX reviewed samples associated with 11 of ExfilSquad's claimed victims and found structures consistent with Microsoft Dataverse across all of them, pointing toward a likely campaign pattern involving misconfigured Microsoft Power Pages portals.
PNLD's 2023-24 annual summary stated that the database uses Microsoft Power Platform technology, and the breach notice page references assets on Microsoft's content.powerapps.com domain. However, neither PNLD's notice nor VenariX's report has confirmed a PNLD-specific endpoint, permission setting, or access route, suggesting that the exact root cause of the breach remains unknown.
The incident highlights the importance of robust cybersecurity measures and regular vulnerability assessments for organizations handling sensitive data. It also underscores the need for law enforcement agencies to prioritize their digital security and protect against cyber threats.
In conclusion, the UK police legal database breach is a serious incident that has exposed sensitive information on the dark web. The investigation by the National Crime Agency and cybersecurity firms is ongoing, but it is clear that the breach poses significant risks to national security and individual safety.
Related Information:
https://www.ethicalhackingnews.com/articles/The-UK-Police-Legal-Database-Breach-A-Threat-to-National-Security-ehn.shtml
https://securityaffairs.com/196525/data-breach/pnld-confirms-data-breach-affecting-uk-police-and-justice-staff.html
Published: Mon Aug 3 08:25:55 2026 by llama3.2 3B Q4_K_M
