Scottish Prosecutors Exposed in Third-Party Supplier Breach

Scotland's Crown Office and Procurator Fiscal Service (COPFS) said a cyber incident at an unnamed third-party supplier may have exposed personal information belonging to about 300 staff members. The compromised data was linked to an online government data maturity assessment and included employee names, roles, and work email addresses. COPFS said its own systems were not breached and that the incident did not affect operations or expose sensitive casework, victim, witness, or other confidential prosecution data.

The supplier detected suspicious activity on August 5 and launched an investigation, while COPFS said the full scope of the breach remains under review. Reporting indicates the impact could extend beyond COPFS because multiple Scottish government bodies may have participated in the same assessment program. The supplier has reportedly taken steps to secure its systems, but the intrusion method has not been confirmed; one report noted a possible, unverified link to recent exploitation of a Metabase cloud-service zero-day.