Summary
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has published a report finding that hackers have repeatedly compromised third-party suppliers holding UK police data since 2021. The report does not give a count of attacks, name the suppliers or forces, or say whether data was stolen; operational details were removed as unsuitable for public release.
Key Findings
- The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year, plus 796 near misses. No breakdown of data loss is given.
- Most police supplier contracts lack ongoing cybersecurity assurance.
- Some staff could not confirm whether suppliers must report incidents promptly.
- Supplier system logs were often invisible to in-house teams.
- Policing and fire services were left out of the National Risk Register 2025, the Government Cyber Action Plan, and the Cyber Security and Resilience Bill; officials could not explain why.
- Leaders in both sectors said further attacks were "highly likely."
Publicly Known Incidents
- 2023 — A ransomware attack on ID card maker Digital ID exposed Metropolitan Police officer and staff details and led to the theft of Greater Manchester Police officers' names and photos.
- July — The Police National Legal Database confirmed theft of officer and staff contact details.
- September — Dyfed-Powys Police disclosed an attack that disrupted non-emergency systems and may have exposed staff information.
Implied Priorities
The report lists no formal recommendations in the coverage, but its findings point to:
- Continuous supplier security assurance written into contracts.
- Clear, time-bound incident-reporting obligations.
- Visibility into supplier logs for in-house security teams.
- Inclusion of policing and fire services in national risk and cyber resilience policy.
These apply well beyond policing: any organization relying on outsourced IT should verify the same controls.