- Messages
- 4,003
- Likes
- 1,873
- Points
- 2,130
Representatives of the British Police National Legal Database (PNLD), a service that provides legal information to police and criminal justice agencies, reported a data breach. The names and work email addresses of police officers, civil servants, and other users of the service have already been published on the dark web.
PNLD is an online legal information service that has been used for over 30 years by local police forces in England and Wales, as well as British Transport Police. PNLD provides police and other organizations working in the criminal justice system with legal materials and reference information.
The compromise of the service was discovered on July 26, 2026. Those affected included police officers, civilian police staff, criminal justice specialists, representatives of government organizations, and PNLD partners and clients. The breach also reportedly affected the names and email addresses of some people who submitted queries through the Ask the Police service.
The British government warns that the stolen data could now be used by attackers to create convincing phishing emails, including those targeted at specific law enforcement officers.
PNLD emphasizes that, based on available information, passwords and other credentials were not compromised in the attack. The organization also reiterated that PNLD is not affiliated with the Police National Computer or the Police National Database, is not used to record crimes, and does not store confidential information about victims, witnesses, or perpetrators.
All affected organizations have been notified of the incident and advised on how to respond. Ask the Police users whose data may have been compromised have also been sent emails. The Information Commissioner's Office has been notified of the incident, and an investigation into the attack is being conducted jointly with the National Crime Agency (NCA) and external information security specialists.
PNLD representatives are not yet disclosing the exact number of victims, the exact time of the attack, how long the attackers maintained access to the service's infrastructure, or the amount of information they stole.
Last week, a statement about the PNLD hack appeared on the ExfilSquad darknet website, and the hackers also published a link to a sample of the stolen data. The attackers are demanding a ransom, or they threaten to release all the stolen information. However, PNLD has not yet officially confirmed that this group was behind the attack.
The hackers claim to have stolen 1.9 GB of data, containing approximately 135,000 law enforcement contacts, including names and email addresses. According to The Times , the dump contains information on 114,000 PNLD users, and the leak also affected data on 21,000 Ask the Police users.
Analysts at the security firm VenariX examined data samples previously published by ExfilSquad, claiming they had stolen the information from various companies. In 11 of the 15 cases, the researchers identified structures consistent with Microsoft Dataverse, and in one instance, they discovered that the public portal was returning records without authentication.
The researchers believe the attackers were able to obtain data from Power Pages, where the Anonymous User role granted excessive privileges to Dataverse tables. Extracting the information would also require an enabled Web API or an outdated OData feed.
However, experts point out that this attack pattern has not been confirmed in the PNLD case: researchers were unable to identify a specific vulnerable endpoint, incorrect configuration, API route, or logs that would explain the leak's origin. Therefore, the connection between the PNLD attack and a Power Pages misconfiguration remains speculative.
PNLD is an online legal information service that has been used for over 30 years by local police forces in England and Wales, as well as British Transport Police. PNLD provides police and other organizations working in the criminal justice system with legal materials and reference information.
The compromise of the service was discovered on July 26, 2026. Those affected included police officers, civilian police staff, criminal justice specialists, representatives of government organizations, and PNLD partners and clients. The breach also reportedly affected the names and email addresses of some people who submitted queries through the Ask the Police service.
The British government warns that the stolen data could now be used by attackers to create convincing phishing emails, including those targeted at specific law enforcement officers.
PNLD emphasizes that, based on available information, passwords and other credentials were not compromised in the attack. The organization also reiterated that PNLD is not affiliated with the Police National Computer or the Police National Database, is not used to record crimes, and does not store confidential information about victims, witnesses, or perpetrators.
All affected organizations have been notified of the incident and advised on how to respond. Ask the Police users whose data may have been compromised have also been sent emails. The Information Commissioner's Office has been notified of the incident, and an investigation into the attack is being conducted jointly with the National Crime Agency (NCA) and external information security specialists.
PNLD representatives are not yet disclosing the exact number of victims, the exact time of the attack, how long the attackers maintained access to the service's infrastructure, or the amount of information they stole.
Last week, a statement about the PNLD hack appeared on the ExfilSquad darknet website, and the hackers also published a link to a sample of the stolen data. The attackers are demanding a ransom, or they threaten to release all the stolen information. However, PNLD has not yet officially confirmed that this group was behind the attack.
The hackers claim to have stolen 1.9 GB of data, containing approximately 135,000 law enforcement contacts, including names and email addresses. According to The Times , the dump contains information on 114,000 PNLD users, and the leak also affected data on 21,000 Ask the Police users.
Analysts at the security firm VenariX examined data samples previously published by ExfilSquad, claiming they had stolen the information from various companies. In 11 of the 15 cases, the researchers identified structures consistent with Microsoft Dataverse, and in one instance, they discovered that the public portal was returning records without authentication.
The researchers believe the attackers were able to obtain data from Power Pages, where the Anonymous User role granted excessive privileges to Dataverse tables. Extracting the information would also require an enabled Web API or an outdated OData feed.
However, experts point out that this attack pattern has not been confirmed in the PNLD case: researchers were unable to identify a specific vulnerable endpoint, incorrect configuration, API route, or logs that would explain the leak's origin. Therefore, the connection between the PNLD attack and a Power Pages misconfiguration remains speculative.