Loading story…
Dyfed-Powys Police in Wales disclosed a cyberattack that disrupted several non-emergency systems, including online and email contact services. The force identified the incident on September 14 and later restored the affected services, while maintaining emergency response operations.
The force said it has found no evidence that public personal data was accessed, but is investigating whether employee information was compromised. It notified the Information Commissioner's Office, engaged cybersecurity specialists, and implemented precautionary measures; Tarian, southern Wales's regional organized-crime unit, is leading the investigation. The intrusion vector, affected staff-data scope, and responsible threat actor remain unknown, with no public claim of responsibility.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Dyfed-Powys Police identified a cyberattack that disrupted several non-emergency systems, including its online and email contact channels. The force found no evidence that public personal data was affected, while investigating possible compromise of employee information.
The force later restored its online and email contact services after they became unavailable following the cyberattack.
Dyfed-Powys Police notified the Information Commissioner's Office, implemented precautionary protections for its systems, and engaged cybersecurity specialists to support its investigation. Tarian, southern Wales's regional organized-crime unit, led the investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
Scotland's Crown Office and Procurator Fiscal Service (**COPFS**) said a cyber incident at an unnamed third-party supplier may have exposed personal information belonging to about 300 staff members. The compromised data was linked to an online government data maturity assessment and included employee names, roles, and work email addresses. COPFS said its own systems were not breached and that the incident did not affect operations or expose sensitive casework, victim, witness, or other confidential prosecution data. The supplier detected suspicious activity on **August 5** and launched an investigation, while COPFS said the full scope of the breach remains under review. Reporting indicates the impact could extend beyond COPFS because multiple Scottish government bodies may have participated in the same assessment program. The supplier has reportedly taken steps to secure its systems, but the intrusion method has not been confirmed; one report noted a possible, unverified link to recent exploitation of a **Metabase** cloud-service zero-day.
Aug 15, 2026