"There is no evidence to suggest that passwords or other security credentials have been compromised," PNLD said.
PNLD confirmation and the data exposed
The Police National Legal Database (PNLD) confirmed on July 26 that police, government and customer contact information was compromised and published on the dark web. PNLD said the exposed fields included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident also exposed some names and email addresses belonging to people who had submitted questions through Ask the Police, a detail the UK government says could make phishing messages targeting named officers appear more convincing.
PNLD emphasised that the service is not the Police National Computer or the Police National Database, is not a crime‑recording system, and does not hold confidential information about victims, witnesses or offenders. The organisation said it contacted all affected organisations, provided further information and guidance, and that affected Ask the Police users have already received an email with more information. PNLD notified the Information Commissioner’s Office (ICO) and is working with the National Crime Agency (NCA) and specialist cybersecurity organisations.
As of August 3, 2026, PNLD had not publicly disclosed how many people were affected, when the intrusion began, how long access lasted, or how much information was taken. Its official breach notice describes exposed fields but provides no victim total. The 2025–26 PNLD annual summary reported 108,429 police registrations and support for all 43 Home Office police forces — a user‑base figure the organisation notes is not a breach‑victim count.
Microsoft Power Platform: a platform link, not a root‑cause finding
PNLD's 2023–24 annual summary states the database uses Microsoft Power Platform technology. The Hacker News confirmed on August 3, 2026 that PNLD’s breach‑notice page referenced assets hosted on Microsoft's content.powerapps.com domain, corroborating a platform connection but not explaining how an attacker obtained the data.
Microsoft's documentation cited in reporting describes a tenant‑level governance control that can block unauthenticated users from reading Dataverse data while still allowing public form submissions. That control sits alongside other Power Platform configuration options that can affect what data a public page exposes.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →VenariX findings and the Power Pages configuration hypothesis
Independent analysis by VenariX reviewed samples linked to 11 of ExfilSquad's 15 claimed victims and found Dataverse‑consistent structures across all 11. In one reviewed case in Houston, VenariX confirmed a public portal returned records without authentication and that those records matched data published by the group.
From those patterns, VenariX assessed a likely campaign‑level path: a public Power Pages site with broad Anonymous Users access to Dataverse tables, combined with an enabled Power Pages Web API or a legacy OData feed. Microsoft’s documentation explains that granting the Anonymous Users role access to a table makes its data visible to anyone visiting the site, and that the /_api Web API follows the table permissions attached to each web role.
VenariX was careful to note, however, that the evidence "does not yet confirm that every organization was affected through an exposed Power Apps portal or the same configuration issue." The organisation recommended that Power Pages operators review Anonymous Users table permissions, Web API settings, and legacy OData feeds, and validate access from an unauthenticated browser session. Those steps address the configuration pattern VenariX identified; they do not establish PNLD’s confirmed root cause.
ExfilSquad listing, investigative status, and forensic gaps
ExfilSquad listed PNLD on its leak site on July 26, but PNLD has not attributed the incident to the group. VenariX found no evidence of ransomware deployment, malware use, lateral movement or exploitation of a software vulnerability in the campaign material it examined. As of August 3, neither PNLD's public notice nor VenariX's report identified a PNLD‑specific endpoint, permission setting, API route, or supporting log that would show exactly how the data left PNLD systems. The Power Pages link therefore remains a hypothesis to test rather than a confirmed explanatory chain.
What this means for police forces, Ask the Police users, and cybersecurity teams
- Police forces: PNLD has said it contacted affected organisations and provided guidance; forces will need to treat PNLD’s user‑base figures (108,429 registrations; support for 43 Home Office forces) as separate from any breach‑victim total, which PNLD has not released.
- Ask the Police users: some question submitters had names and emails exposed and have already received notification and guidance from PNLD; the UK government guidance warns that named contacts could increase the believability of phishing messages.
- Cybersecurity teams: VenariX’s recommended checklist — review Anonymous Users table permissions, Web API and legacy OData feed settings, and validate unauthenticated browser access — targets the configuration pattern the analysts observed. PNLD is working with the NCA, the ICO and specialist cybersecurity organisations as the investigation continues.
PNLD’s confirmation that contact data reached the dark web is clear; the unanswered technical questions remain equally plain. Neither a definitive access route nor a victim total has been published as of August 3, 2026, and the Power Pages/Dataverse configuration pattern identified by VenariX is an investigatory hypothesis rather than a confirmed explanation. PNLD’s engagement with the ICO and the NCA, and VenariX’s public recommendations, mark immediate next steps — but the record still requires the specific endpoint, permission setting, or log evidence that would move hypothesis to finding.
