Loading story…
Natural Resources Wales (NRW), Wales’ government-sponsored environmental regulator, disclosed special-category personal data for roughly 2,000 current and former employees through a spreadsheet published in response to a Freedom of Information request. The file, uploaded in 2021 and covering staff employed from April 2013 through March 2018, exposed data including ethnicity, disability status, religion or belief, sexual orientation, Welsh-language ability, and caring responsibilities.
NRW said the disclosure resulted from human error and was discovered years after publication. The regulator removed the spreadsheet, obtained confirmation that it had been permanently deleted, and reported the breach to the UK Information Commissioner’s Office; it said it has found no evidence that the information was misused.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Natural Resources Wales published a spreadsheet in response to a Freedom of Information request. The spreadsheet contained equality and diversity-monitoring data for employees who worked for NRW between April 2013 and March 2018.
Years after publication, Natural Resources Wales identified that the spreadsheet had exposed sensitive data relating to approximately 2,000 current and former employees. NRW removed the material, obtained confirmation of permanent deletion, reported the breach to the ICO, and said it found no evidence of misuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcemalware.news
Open sourcenaturalresources.wales
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dyfed-Powys Police in Wales disclosed a cyberattack that disrupted several non-emergency systems, including online and email contact services. The force identified the incident on September 14 and later restored the affected services, while maintaining emergency response operations. The force said it has found no evidence that public personal data was accessed, but is investigating whether employee information was compromised. It notified the Information Commissioner's Office, engaged cybersecurity specialists, and implemented precautionary measures; Tarian, southern Wales's regional organized-crime unit, is leading the investigation. The intrusion vector, affected staff-data scope, and responsible threat actor remain unknown, with no public claim of responsibility.
Sep 28, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
NHS Forth Valley is investigating a data protection incident after a staff member emailed a spreadsheet containing sensitive maternity patient information to a personal email account. The breach affected about 150 women who used local maternity services, and the exposed data reportedly included names, dates of birth, NHS numbers, pregnancy treatment details, and, for some patients, the total number of children. The Scottish health trust said there is no evidence the information was shared more widely and that the staff member reported deleting the email. NHS Forth Valley has notified affected patients and reported the incident to the UK Information Commissioner’s Office and Police Scotland while an internal investigation continues.
Jul 10, 2026