Data of over 100,000 UK police officers leaked on dark web

The data of more than 100,000 UK police officers and staff has appeared on the dark web after hackers breached a key law enforcement database, The Times has reported.

The leak came just days after the cybercriminals published over half a million pieces of sensitive information from the British Education Ministry.

The perpetrators were able to gain access to the Police National Legal Database (PNLD), which is used by members of law enforcement in England and Wales, The Times said in an article on Sunday.

Police sources told the paper that some 114,000 PNLD subscribers, mostly officers, had their names and contact details uploaded online.

The hackers also exposed data from 2,615 Crown Prosecution Service employees, 617 Home Office personnel, 588 National Crime Agency staff, and 402 workers of the British Defense Ministry, they added.

The email addresses of some 21,000 members of the public who visited the Ask the Police website were also released as part of the leak, according to the article.

No passwords or security credentials appear to have been compromised so far, The Times said.

A group called ExfilSquad is believed to be behind the latest breaches, the paper noted. Its members allegedly do not follow any ideology, but engage in cybercrime in order to profiteer at the expense of their victims, it added.

An online statement by the group urged those affected by the hack to “be smart and just pay” to see their data taken down from the dark web. “The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking,” it claimed.

One of the officials whose details were released told The Times that “for private information to be leaked about me is very disconcerting and puts officers at serious risk.”

The chairwoman of the Police Federation, Tiff Lynch, said that the hack “raises serious concerns for officer and staff safety.” The police should be “properly funded to ensure the strongest possible cyber security protections are in place to safeguard sensitive personal data,” she insisted.

A 10 Downing Street spokesperson said the British government has “dedicated capabilities to respond to cyber incidents, and it would be inappropriate to comment on a live investigation.”

Sensitive UK police data has appeared online on a number of occasions in recent years. In 2023, the data of thousands of Metropolitan and Greater Manchester police (GMP) officers was compromised in a ransomware attack that targeted an IT firm servicing both forces.

The leak happened just weeks after the details of some 10,000 Northern Ireland police employees were published online after being accidentally included in a response to a freedom of information request.