Loading story…
Scotland's Crown Office and Procurator Fiscal Service (COPFS) said a cyber incident at an unnamed third-party supplier may have exposed personal information belonging to about 300 staff members. The compromised data was linked to an online government data maturity assessment and included employee names, roles, and work email addresses. COPFS said its own systems were not breached and that the incident did not affect operations or expose sensitive casework, victim, witness, or other confidential prosecution data.
The supplier detected suspicious activity on August 5 and launched an investigation, while COPFS said the full scope of the breach remains under review. Reporting indicates the impact could extend beyond COPFS because multiple Scottish government bodies may have participated in the same assessment program. The supplier has reportedly taken steps to secure its systems, but the intrusion method has not been confirmed; one report noted a possible, unverified link to recent exploitation of a Metabase cloud-service zero-day.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
COPFS disclosed that a cyber incident at an external supplier may have exposed employment-related information for around 300 staff, including names, roles, and work email addresses. COPFS said its own systems were not compromised and that case, victim, witness, and other sensitive prosecution data were unaffected.
The unnamed third-party supplier detected suspicious activity affecting its internal network and launched an investigation. The activity reportedly resulted in loss of government employee data.
The Scottish government's Data Maturity Programme began in 2021 and includes yearly cohorts and a Data Maturity Assessment involving public sector organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcetheregister.com
Open sourcecopfs.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
Dyfed-Powys Police in Wales disclosed a cyberattack that disrupted several non-emergency systems, including online and email contact services. The force identified the incident on September 14 and later restored the affected services, while maintaining emergency response operations. The force said it has found no evidence that public personal data was accessed, but is investigating whether employee information was compromised. It notified the Information Commissioner's Office, engaged cybersecurity specialists, and implemented precautionary measures; Tarian, southern Wales's regional organized-crime unit, is leading the investigation. The intrusion vector, affected staff-data scope, and responsible threat actor remain unknown, with no public claim of responsibility.
Sep 26, 2026
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026