"Information including the names, organizations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web. There is no evidence to suggest that passwords or other security credentials have been compromised," the Police National Legal Database (PNLD) said in an August 3 statement.
PNLD: what was hit, when it was detected, and what it holds
The PNLD — a service managed by West Yorkshire Police — disclosed a "data security incident" it identified on July 26 and announced publicly on August 3. The database contains information on officers from all 43 police forces in England and Wales, and also covers the British Transport Police, the Crown Prosecution Service, the Independent Office for Police Conduct, and His Majesty's Courts and Tribunals Service.
The PNLD said the compromised material includes names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers. It emphasised that it does not hold any confidential information relating to victims, witnesses or offenders.
ExfilSquad: the group claiming responsibility and the scale they allege
ExfilSquad, the extortion group that recently targeted the Department for Education, claimed responsibility for the PNLD incident. Screenshots of the group's leak site posted to X showed ExfilSquad asserting it had 1.9GB of data and "135,000 records," and that it published a subset to prove its claim.
The group's messaging on the leak site included a direct note to the victim: "Once your company’s data is posted here it’s never leaving the public eye and will be passed around the internet forever," and, "The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay."
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Ask the Police: secondary exposure and notifications
The PNLD said the Ask the Police service it operates was also impacted. As a result, "some names and email addresses of people who have previously submitted a question to Ask the Police have been published on the dark web." The notice added that anyone affected would already have received an email from Ask the Police with more information and guidance.
Incident response: investigations and law-enforcement engagement
Since identifying the incident, PNLD said it has been "working with specialist cybersecurity organisations and the National Crime Agency to investigate the circumstances and take appropriate action." The PNLD also noted there is "no evidence" that passwords or other security credentials were taken.
What this means for police officers, government partners, and cyber defenders
- Police officers and justice staff: Their names and work email addresses are among the items PNLD confirmed were published on the dark web; the PNLD and Ask the Police said affected individuals would have been notified by email.
- Government partners and customers: The PNLD statement lists them as among the compromised records; the incident aligns with a stated UK government intention to introduce a de facto ban on public sector organisations paying extortion demands, a factor the PNLD said makes payment unlikely.
- Cybersecurity professionals and defenders: Dray Agha, senior manager, security operations center EMEA at Huntress, warned that although passwords were not exposed, "exposing the names and work emails of UK police and justice staff on the dark web hands cybercriminals a readymade directory to launch highly targeted spear-phishing and social engineering attacks against the very people defending our justice system."
The PNLD breach sits at the intersection of public-service data holdings, extortionate leak tactics, and a government stance that discourages ransom payments. PNLD's stated investigatory steps — working with specialist cybersecurity organisations and the National Crime Agency — are the immediate next moves within the record. For individuals named in the published material, the PNLD and Ask the Police have issued direct notifications and guidance; for the organisation, the competing forces are the claimed scale of ExfilSquad's haul and the stated UK government approach that makes paying extortion less likely.
Link to original story: https://www.infosecurity-magazine.com/news/uks-police-national-legal-database/
