--- title: "Dyfed-Powys Police confirms cyber attack as sta… | Firevault" url: https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 description: "Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The…" lang: en-GB --- Breaking News Updated as information becomes available News · Breach Analysis · 25 September 2026 · Breaking # Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor CTO, CMO & Founder, Firevault 3 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdyfed-powys-police-cyber-attack-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdyfed-powys-police-cyber-attack-2026&text=Dyfed-Powys%20Police%20confirms%20cyber%20attack%20as%20staff%20information%20may%20have%20been%20compromised%0A%0ADyfed-Powys%20Police%20has%20confirmed%20that%20a%20cyber%20attack%20identified%20on%2014%20September%20disrupted%20non-emergency%20systems%20and%20may%20have%20exposed%20staff%20information.%20The%20force%20says%20it%20has%20found%20no%20evidence%20that%20public%20data%20was%20accessed. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdyfed-powys-police-cyber-attack-2026 Image: A darkened police control room with locked security screens and the Welsh hills beyond the window (https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg) A darkened police control room with locked security screens and the Welsh hills beyond the window Why it matters ## What this means for organisations holding critical data ## What happened Dyfed-Powys Police has confirmed that it suffered a cyber attack, identified on 14 September 2026, which disrupted some of its non-emergency systems, according to Sky News (https://news.sky.com/story/dyfed-powys-police-says-it-has-suffered-a-cyber-attack-13591654) and BBC News (https://www.bbc.co.uk/news/articles/c8dx573qnlpwo). Online and email contact with the force was unavailable for a period after the incident. At the time, the force described the problem publicly only as "technical difficulties", as The Pembrokeshire Herald (https://pembrokeshire-herald.com/148603/dyfed-powys-police-warns-of-delays-amid-technical-difficulties/) reported on 15 September. Those services have now been restored. The force says 999 and 101 were not affected and that it remained fully operational throughout. The force says it is receiving support from cyber security specialists, that its systems have been subject to "precautionary measures" while the investigation continues, and that the Information Commissioner's Office (ICO) has been notified. ## What the force has said about data A spokesperson said: "At this stage, our investigation has found no evidence that members of the public's personal data has been accessed or compromised as a result of this incident." The force added: "We are, however, continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required." ## What is not yet known The force has not said who was responsible, how the attackers gained access, whether ransomware was involved or whether any demand has been made. No group has been publicly confirmed as responsible. It is also not yet known which categories of staff information, if any, were taken. Firevault will not speculate beyond what the force has confirmed. ## Why this matters Dyfed-Powys is the largest police force in England and Wales by area, covering Carmarthenshire, Ceredigion, Pembrokeshire and Powys and serving more than 500,000 residents, as LBC (https://www.lbc.co.uk/article/cyber-attack-wales-police-dyfed-powys-5Hjdhyr_2/) noted. Police staff information is not ordinary personnel data. Names, roles, home addresses and contact details of officers and staff can create personal safety risks, not just privacy risks. The incident follows a pattern seen across UK public services: emergency functions are protected and stay up, while the connected back-office estate that holds staff, case and administrative records becomes the exposure point. ## The Firevault view The service can stay online. The retained data does not have to. Keeping 999 and 101 running is the right priority, and the force deserves credit for that. The harder question for every police force, council and public body is which records need to be permanently reachable from the same network that attackers are probing, and which do not. Historic HR files, vetting records, archived case material and older administrative data are rarely needed day to day. Holding those records in Offline Secure Storage (https://fire-vault.com/offline-secure-storage)®, physically disconnected until an authorised person needs them, means an intrusion into the live network cannot reach them. It also gives the organisation a clean, untouched copy to recover from if live systems are encrypted or altered. ## What public bodies should do now - Identify which staff and case records are held on connected systems and how long they have been retained. - Separate records that must be live from those that only need to be kept. - Move retained, rarely accessed records to physically offline storage with controlled, logged access. - Test recovery from an offline copy, not only from connected backups. - Plan staff communications in advance, including practical personal safety advice where officer details may be exposed. About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 Breach Analysis ### Southampton council reported seven serious data breaches in a year, including a lost notebook with 224 residents' details Southampton City Council referred seven incidents to the Information Commissioner's Office in 2025/26, including a social worker's lost notebook containing the names, addresses and key safe numbers of 224 people. Mark Fermor on what a notebook, a miscatalogued archive and a curious officer tell us about the data organisations still cannot control. 16 Sept 2026 5 min https://fire-vault.com/news/southampton-council-seven-serious-data-breaches-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026#webpage", "url": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026", "name": "Dyfed-Powys Police confirms cyber attack as sta…", "description": "Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Dyfed-Powys Police confirms cyber attack as staff information may have been compromised", "item": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Dyfed-Powys Police confirms cyber attack as staff information may have been compromised", "description": "Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed.", "url": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Fdyfed-powys-police-cyber-attack-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-25T11:10:00+00:00", "dateModified": "2026-09-25T11:04:12.261397+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 567, "keywords": "Dyfed-Powys, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened Dyfed-Powys Police has confirmed that it suffered a cyber attack, identified on 14 September 2026, which disrupted some of its non-emergency systems, according to [Sky News](https://news.sky.com/story/dyfed-powys-police-says-it-has-suffered-a-cyber-attack-13591654) and [BBC News](https://www.bbc.co.uk/news/articles/c8dx573qnlpwo). Online and email contact with the force was unavai", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "When did the Dyfed-Powys Police cyber attack happen?", "acceptedAnswer": { "@type": "Answer", "text": "The force says the incident was identified on 14 September 2026. It confirmed publicly on 25 September that it had been a cyber attack." } }, { "@type": "Question", "name": "Was the public's personal data stolen?", "acceptedAnswer": { "@type": "Answer", "text": "The force says its investigation has found no evidence so far that members of the public's personal data was accessed or compromised. It is still investigating whether staff information was affected." } }, { "@type": "Question", "name": "Were 999 and 101 affected?", "acceptedAnswer": { "@type": "Answer", "text": "No. The force says 999 and 101 continued to work and that it remained fully operational. Online and email contact was unavailable for a period and has now been restored." } }, { "@type": "Question", "name": "Who was behind the attack?", "acceptedAnswer": { "@type": "Answer", "text": "The force has not named anyone responsible or said whether ransomware was involved. The ICO has been notified and the investigation is ongoing." } } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```