Loading story…
Personal data for more than 100,000 UK police officers and staff was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included full names and contact details, with reporting indicating the incident also impacted the Ministry of Defence, Home Office, National Crime Agency, and Crown Prosecution Service, adding to concerns over the exposure of sensitive law-enforcement and government personnel records.
The intrusion has been attributed in reporting to the cybercriminal group ExfilSquad, which allegedly listed the victims on its leak site and claimed the access stemmed from Microsoft Power Apps and Dynamics 365 misconfigurations. Specifically, the group said improperly configured permissions on Dataverse tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the Department for Education.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Police National Legal Database said it detected a cyberattack on July 26 and confirmed that names, organizations, and email addresses of more than 100,000 police officers, criminal justice professionals, government partners, and Ask the Police users were exposed. PNLD said affected organizations were notified, the ICO was informed, and the National Crime Agency was assisting the investigation.
ExfilSquad listed the Police National Legal Database on its leak site on July 26, claiming it stole about 1.9 GB of data covering roughly 135,000 records, including subscriber and Ask the Police user data. The group said it would release remaining material unless a ransom was paid, though PNLD did not confirm the attribution.
Full names and contact details of more than 100,000 UK police officers and staff were reportedly published on the dark web following the breach. The exposed dataset was described as part of a major security incident affecting UK government and law-enforcement personnel information.
In a separate incident described as occurring the previous week, more than half a million pieces of Department for Education data were reportedly compromised. The reference presents this as distinct from the broader UK government breach.
Hackers believed to be ExfilSquad reportedly compromised data belonging to several UK government entities, including the Ministry of Defence, Home Office, National Crime Agency, and Crown Prosecution Service. The group was also said to have attributed the victims on its leak site to Microsoft Power Apps and Dynamics 365 misconfigurations involving Dataverse table permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 12, 2026
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026