U.K. Police Database Breach Exposes Officer and Government Contact Details on Dark Web

A cyberattack on the Police National Legal Database (PNLD) has compromised the contact information of police officers, government partners and criminal justice professionals, with the stolen data appearing on the dark web as of July 26, 2026.

The breach raises immediate concerns about targeted phishing attacks against named law enforcement personnel. According to U.K. government guidance, exposed names and work email addresses can make fraudulent messages appear significantly more convincing — a risk that extends beyond individual officers to the broader criminal justice system that depends on secure internal communications. Organisations that have not yet reviewed their exposure risk from sensitive data held in public-facing systems should treat this incident as a prompt to do so.

What Was Exposed and Who Is Affected

The compromised data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. Some names and email addresses of members of the public who submitted questions through the Ask the Police service were also caught in the breach.

PNLD moved quickly to contain the fallout. The organisation contacted all affected organisations and provided guidance. Affected Ask the Police users received direct email notifications with further instructions.

"There is no evidence to suggest that passwords or other security credentials have been compromised," PNLD stated in its official breach notice.

Critically, PNLD is not the Police National Computer or the Police National Database. It does not operate as a crime-recording system and holds no confidential information about victims, witnesses or offenders. That distinction matters when assessing the operational risk to active investigations — the breach is serious, but its scope is bounded.

The organisation has notified the Information Commissioner's Office (ICO) and is working with the National Crime Agency (NCA) alongside specialist cybersecurity organisations.

As of August 3, 2026, PNLD had not publicly disclosed how many individuals were affected, when the intrusion began, how long access lasted or the total volume of data published. PNLD's 2025-26 annual summary reported 108,429 police registrations and support for all 43 Home Office police forces — though that figure represents the user base and not a confirmed breach victim count. The absence of timely disclosure on these specifics has itself become a point of regulatory and reputational pressure.

Why Phishing Risk Is Elevated

When named law enforcement personnel and their work email addresses are publicly associated with specific organisations on the dark web, the conditions for convincing spear-phishing attacks are significantly improved. Attackers can craft messages that reference real job titles, departments and colleague names — dramatically increasing the likelihood that a target will engage. Security awareness training and strict email verification protocols become essential mitigations in the immediate aftermath of a breach of this kind.

The Microsoft Power Platform Connection

Investigators are now examining whether a misconfigured Microsoft Power Pages environment may have enabled the attack. PNLD's 2023-24 annual summary confirmed the database uses Microsoft Power Platform technology. The Hacker News independently verified on August 3, 2026, that PNLD's breach-notice page referenced assets hosted on Microsoft's content.powerapps.com domain.

How the Suspected Vulnerability Works

Cybersecurity firm VenariX reviewed data samples associated with 11 of the 15 organisations claimed as victims by a threat actor group called ExfilSquad. Across all 11 cases, VenariX found data structures consistent with Microsoft Dataverse. In at least one case — involving a Houston-based organisation — VenariX confirmed that a public portal returned records without requiring any authentication.

VenariX assessed the likely campaign-level path as a public Power Pages site configured with broad Anonymous Users access to Dataverse tables. That configuration, combined with an enabled Power Pages Web API or legacy OData feed, could allow anyone visiting the site to read sensitive records. Microsoft's own documentation confirms that granting the Anonymous Users role access to a table makes its data visible to unauthenticated visitors — a default permission that many administrators may not have consciously set.

ExfilSquad listed PNLD on its leak site on July 26, though PNLD has not formally attributed the incident to that group. VenariX found no evidence of ransomware deployment, malware use, lateral movement or exploitation of a known software vulnerability in the campaign material it examined.

Importantly, neither PNLD's official notice nor VenariX's report has identified a PNLD-specific endpoint, permission setting, API route or supporting log that confirms this configuration was the actual entry point. "The evidence does not yet confirm that every organization was affected through an exposed Power Apps portal or the same configuration issue," VenariX stated. The Power Pages hypothesis remains unconfirmed as the investigation continues.

The Broader Low-Code Risk Pattern

This incident underscores a tension familiar to anyone who has watched enterprise cloud adoption accelerate over the past decade — the same low-code tools that allow organisations to deploy public-facing portals quickly can introduce serious exposure when default permissions go unreviewed. For a deeper understanding of the structural risks involved, Microsoft's Power Pages security documentation provides a detailed reference on how table permissions and anonymous access controls interact within Dataverse environments.

Understanding how to prevent a data breach through configuration and access control reviews is no longer a concern limited to traditional IT infrastructure — it applies directly to low-code platforms now embedded in public-sector operations.

Steps Organisations Should Take Now

Microsoft provides a tenant-level governance control that blocks unauthenticated users from reading Dataverse data while still allowing public form submissions — a straightforward setting many administrators may have overlooked.

VenariX recommends that all Power Pages operators take the following steps immediately:

• Review Anonymous Users table permissions within their Dataverse environment
• Audit Web API settings and legacy OData feed configurations
• Validate access controls by running a test from an unauthenticated browser session

Those measures address the configuration pattern VenariX identified across the broader ExfilSquad campaign. They do not represent a confirmed fix for the PNLD breach specifically, since the root cause has not been publicly established.

What Security and Compliance Teams Should Act On

For security and compliance teams, this breach offers three immediate areas of focus.

First, audit any public-facing Power Pages portals for anonymous access to Dataverse tables before the next scheduled review cycle — the exposure identified in the ExfilSquad campaign requires no sophisticated exploitation, only an unreviewed permission setting.

Second, treat work email addresses for law enforcement and government staff as high-value phishing targets. Those affected by this breach should receive additional training and be subject to stricter email verification protocols without delay.

Third, organisations holding data on behalf of public-sector clients should review their breach notification timelines now. PNLD's delay in disclosing victim numbers highlights the reputational and regulatory pressure that follows incomplete public communication after an incident. Having a structured data breach response plan in place before an incident occurs is what separates organisations that manage the fallout effectively from those that compound it.

The conditions that made this breach possible — a public-facing portal, permissive defaults and insufficient post-deployment access review — are not unique to PNLD. Any organisation running Power Pages environments, or comparable low-code public portals, should treat this incident as a direct prompt to validate their own configurations.