UK Police Database Security Breach Exposes Staff Data
Officers' and justice professionals' personal details leaked on dark web.
1Breach Scope
The Police National Legal Database (PNLD), used by all 43 UK police forces, suffered a breach exposing officers', staff, and justice professionals' names and work emails. The public-facing Ask the Police service on the same platform was also compromised. The 2025-26 report shows 108,429 police registrations, but the exact number affected remains undisclosed. Leaked data published on dark web doesn't include passwords. National Crime Agency (NCA) and cybersecurity firms are investigating.
2Risks Identified
The breach creates two risk groups: Police personnel are now vulnerable to targeted phishing using their exposed details, while citizens who contacted Ask the Police had their police interactions revealed on dark web. PNLD isn't a crime recording system, so victim/witness data remains safe. All affected organizations received notifications, and UK Information Commissioner's Office (ICO) was informed. The exposure highlights critical vulnerabilities in public sector cloud systems.
3Compromise Method
Cybersecurity firm VenariX points to misconfigured Microsoft Power Pages portals as likely entry point. Overly permissive table access settings may have allowed anonymous users to read Dataverse records. PNLD's 2023-24 report confirms Microsoft Power Platform usage. Microsoft documentation shows Power Pages can expose Dataverse tables via Web API. The exact PNLD-specific configuration error remains unconfirmed, but evidence suggests a pattern across multiple victims.
4ExfilSquad Connection
Ransomware group ExfilSquad listed PNLD on its leak site on July 26. VenariX analyzed 11 of ExfilSquad's 15 claimed victims, finding Microsoft Dataverse structures in all cases. This indicates potential campaign targeting misconfigured Power Pages portals. PNLD hasn't attributed the breach to ExfilSquad. Microsoft provides tenant-level controls to block Dataverse data reads while allowing public form submissions—a configuration that should be validated pre-deployment.
5Microsoft Power Pages Vulnerability
VenariX recommends organizations review Anonymous Users table permissions, Web API settings, and legacy OData feeds, then validate access from unauthenticated sessions. The likely breach path involves: Public Power Pages portal → Anonymous Users web role → Broad table permissions → Power Pages Web API/OData → Data export. Microsoft's configuration allowing form submissions while blocking data reads could have prevented this breach if implemented properly.
6Organizational Measures
VenariX urges Microsoft Power Pages users to immediately review anonymous access permissions. PNLD's breach notice references Microsoft's content.powerapps.com domain, corroborating platform connection. The incident underscores the critical need for proactive security audits before cloud deployment. Public sector entities using similar platforms must prioritize configuration reviews to prevent comparable breaches. Proper permission settings could have averted this significant data exposure.
7Individual Precautions
Affected police personnel should remain vigilant against targeted phishing using their exposed name-organization-email combinations. Citizens who used Ask the Police service should watch for scams referencing their police interactions. PNLD provided guidance to all impacted parties. This breach demonstrates how seemingly minor configuration errors in public-facing systems can have far-reaching consequences for both officials and civilians interacting with government services.
8Sector-wide Implications
The incident reveals devastating consequences of configuration errors in public sector cloud systems. Widely used platforms like Microsoft Power Platform pose significant risks when security settings aren't properly implemented. This breach exposing UK police and justice system vulnerabilities serves as warning for other countries using similar systems. It reinforces the necessity of proactive security audits, especially for government databases containing sensitive professional data.
Original article: Security Affairs — İngiltere Polis Veri Tabanında Güvenlik İhlali