Loading story…
More than 40 UK police forces have migrated sensitive operational data to Microsoft Azure under the government’s cloud-first policy, despite a 2017 policing risk assessment warning that the environment could expose information to cybercriminals, foreign actors, or US government insiders. The data reportedly includes criminal records, victim statements, intelligence, internal emails, body-worn-camera footage, digital evidence, and court records; some material may exceed the UK government’s Official classification.
The assessment warned that data and metadata could be processed globally and that Microsoft-native encryption would not necessarily prevent access by Microsoft personnel or a government acting under legal compulsion, including potential demands under the US CLOUD Act. Microsoft and the National Police Chiefs’ Council said access is tightly controlled, police data normally resides in UK datacentres, and Microsoft has never disclosed UK government data to a US or global authority; however, legal and technical experts said US jurisdiction, worldwide support access, and limited visibility into disclosures leave residual risk. No confirmed compromise of UK police data has been reported.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
The Guardian reported that sensitive data from more than 40 UK police forces was hosted in Microsoft Azure despite the 2017 risk warnings. The report found no confirmed breach or foreign-government disclosure; the NPCC and Microsoft said access was controlled and denied direct or unrestricted government access.
Microsoft told Police Scotland that police data could leave the United Kingdom and that it could not guarantee data sovereignty.
UK police stakeholders assessed 15 risks related to transferring data to Microsoft's global cloud, in a document chaired and signed off by Ian Dyson. It warned of software vulnerabilities, worldwide processing and storage, cybercriminal and foreign-actor targeting, and possible compromise by US government insiders.
UK police forces began migrating operational and sensitive data to Microsoft Azure; more than 40 forces ultimately used the platform, with Azure used wholly or partly by every force.
The UK government's Cabinet Office adopted a cloud-first policy that later underpinned police use of cloud services, including Microsoft Azure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police suffered a major data theft attributed to a **Russian cyber group** after attackers gained access via an employee’s **email account** and exfiltrated sensitive personnel information. Stolen data reportedly included the contact details of nearly all **~65,000 police officers**, along with profile photos and other personal data, triggering significant internal unrest and concern about officer safety and privacy. Investigative reporting indicates the organization had been **warned in advance** about security weaknesses relevant to the intrusion path. Documents obtained under the Netherlands’ Open Government/Woo framework describe an internal **November 2022 risk analysis** that raised concerns about the implementation and security of Microsoft’s **M365 cloud** (used for tools such as *Teams*), explicitly noting “inherent” cloud risks and that **state actors** would be highly motivated to access the environment. Following the 2024 theft, police reportedly stood up a heavy crisis response structure (the *Nationale Staf Grootschalig en Bijzonder Optreden*) to reduce immediate risk and implement additional security measures, while political and union voices characterized the incident as severe and questioned why earlier warnings were not acted upon.
Jun 29, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026