--- title: "Police Legal Database Breach Exposes More Than… | Firevault" description: "A cyber attack on the Police National Legal Database has exposed the names, organisations and work email addresses of more than 100,000 police officers,…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026#webpage", "url": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026", "name": "Police Legal Database Breach Exposes More Than…", "description": "A cyber attack on the Police National Legal Database has exposed the names, organisations and work email addresses of more than 100,000 police officers,…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/pnld-police-legal-database-2026-vibrant.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Police Legal Database Breach Exposes More Than 100,000 Officers and Staff", "item": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Police Legal Database Breach Exposes More Than 100,000 Officers and Staff", "description": "A cyber attack on the Police National Legal Database has exposed the names, organisations and work email addresses of more than 100,000 police officers, police staff and criminal justice professionals. The extortion group ExfilSquad claims around 135,000 records.", "url": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/pnld-police-legal-database-2026-vibrant.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/pnld-police-legal-database-2026-vibrant.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/pnld-police-legal-database-2026-vibrant.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/hero-images/pnld-police-legal-database-2026-vibrant.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-06T20:26:58.429358+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/pnld-police-legal-database-breach-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 670, "keywords": "Police, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "The contact details of more than 100,000 police officers, police staff and criminal justice professionals have been exposed following a cyber attack on the Police National Legal Database (PNLD), the legal reference service used by all 43 Home Office police forces in England and Wales as well as the British Transport Police. The breach was reported by Computing on 4 August 2026. What Happened PNLD ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What data was taken in the PNLD breach?", "acceptedAnswer": { "@type": "Answer", "text": "The Police National Legal Database has confirmed that names, organisations and work email addresses of police officers, police staff, criminal justice professionals and government partners were accessed, along with names and email addresses of members of the public who submitted questions through the Ask the Police website. PNLD states that the database does not hold confidential information about victims, witnesses or offenders, and that there is no evidence login credentials were accessed." } }, { "@type": "Question", "name": "Who is behind the PNLD attack?", "acceptedAnswer": { "@type": "Answer", "text": "The data extortion group ExfilSquad has claimed responsibility, saying it took around 1.9GB of data containing approximately 135,000 records. The same group has been linked to the recent Department for Education breach. PNLD has not publicly attributed the attack." } }, { "@type": "Question", "name": "How does offline secure storage reduce this kind of exposure?", "acceptedAnswer": { "@type": "Answer", "text": "Offline Secure Storage keeps records physically disconnected at the hardware level, so subscriber lists, historic reference data and archived case material cannot be read, copied or encrypted by an attacker who is already inside an online estate. Only the data that genuinely needs to be permanently reachable remains online." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More Buy your Vault Overview What HappenedWhy It MattersA Pattern Across the Public SectorThe Firevault ViewSourcesMore Resources [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · Breach Analysis · 6 August 2026 # Police Legal Database Breach Exposes More Than 100,000 Officers and Staff A cyber attack on the Police National Legal Database has exposed the names, organisations and work email addresses of more than 100,000 police officers, police staff and criminal justice professionals. The extortion group ExfilSquad claims around 135,000 records. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 4 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fpnld-police-legal-database-breach-2026)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fpnld-police-legal-database-breach-2026&text=Police%20Legal%20Database%20Breach%20Exposes%20More%20Than%20100%2C000%20Officers%20and%20Staff%0A%0AA%20cyber%20attack%20on%20the%20Police%20National%20Legal%20Database%20has%20exposed%20the%20names%2C%20organisations%20and%20work%20email%20addresses%20of%20more%20than%20100%2C000%20police%20officers%2C%20police%20staff%20and%20criminal%20justice%20professionals.%20The%20extortion%20group%20ExfilSquad%20claims%20around%20135%2C000%20records.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fpnld-police-legal-database-breach-2026)[](mailto:?subject=Police%20Legal%20Database%20Breach%20Exposes%20More%20Than%20100%2C000%20Officers%20and%20Staff&body=A%20cyber%20attack%20on%20the%20Police%20National%20Legal%20Database%20has%20exposed%20the%20names%2C%20organisations%20and%20work%20email%20addresses%20of%20more%20than%20100%2C000%20police%20officers%2C%20police%20staff%20and%20criminal%20justice%20professionals.%20The%20extortion%20group%20ExfilSquad%20claims%20around%20135%2C000%20records.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fpnld-police-legal-database-breach-2026) ![Dimly lit police records office at night with rows of legal reference binders, a police lanyard on the desk and an unplugged network cable beside a dark monitor](/hero-images/pnld-police-legal-database-2026-vibrant.jpg) Dimly lit police records office at night with rows of legal reference binders, a police lanyard on the desk and an unplugged network cable beside a dark monitor Why it matters ## What this means for organisations holding critical data A cyber attack on the Police National Legal Database has exposed the names, organisations and work email addresses of more than 100,000 police officers, police staff and criminal justice professionals. The extortion group ExfilSquad claims around 135,000 records. In this analysis 1. 01 [What Happened](#section-0) 2. 02 [Why It Matters](#section-1) 3. 03 [A Pattern Across the Public Sector](#section-2) 4. 04 [The Firevault View](#section-3) **On this page**[What Happened](#section-0)[Why It Matters](#section-1)[A Pattern Across the Public Sector](#section-2)[The Firevault View](#section-3) **The contact details of more than 100,000 police officers, police staff and criminal justice professionals have been exposed** following a cyber attack on the Police National Legal Database (PNLD), the legal reference service used by all 43 Home Office police forces in England and Wales as well as the British Transport Police. The breach was [reported by Computing](https://www.computing.co.uk/news/2026/security/uk-police-legal-database-breach-exposes-details-of-more-than-100-000-officers-and-staff) on 4 August 2026. ## What Happened PNLD detected the intrusion on 26 July and has since confirmed that names, organisations and work email addresses of police officers, police staff, criminal justice professionals and government partners were accessed. The names and email addresses of members of the public who submitted questions through the Ask the Police website were also compromised. The service states that the database does not contain confidential information about victims, witnesses or offenders, and that there is no evidence that passwords or other login credentials were accessed. Affected organisations have been notified and the Information Commissioner's Office has been informed. The National Crime Agency and external cyber security specialists are assisting with the investigation. The data extortion group ExfilSquad has claimed responsibility, saying it took around 1.9GB of data containing approximately 135,000 records, of which about 114,000 relate to PNLD subscribers and 21,000 to users of Ask the Police. A sample has been published online and a ransom demanded for the remainder. ## Why It Matters A verified list of serving police officers and criminal justice professionals, complete with organisation and work email address, is not ordinary contact data. It is a targeting list. One police staff member whose details were exposed told _The Times_ that the leak was deeply unsettling because of their work against serious organised crime. For officers involved in sensitive investigations, exposure of identity and employer is a personal safety issue as much as a data protection one. For everyone else on the list, it is the raw material for convincing phishing and impersonation, because an attacker who can appear to be a trusted legal reference service or a colleague in another force has a very short route into systems that hold far more sensitive material. ## A Pattern Across the Public Sector This incident follows the [Department for Education breach](/news/dfe-cyber-attack-607000-records-2026), in which around 607,000 records were exposed in an attack also claimed by ExfilSquad. UK Government Investments has separately disclosed a breach that left internal information and the work contact details of dozens of officials exposed online for close to 48 hours. Graham Taylor, Director of Defence Strategy for Northern Europe at OPSWAT, said the immediate priority should be protecting officers whose identities have been exposed, particularly those involved in organised crime investigations, and added: "The uncomfortable truth is that much of the UK's public sector, with significant legacy systems and fragmented oversight, is years behind the resourcing and resilience needed to combat current and future cyber threats." ## The Firevault View Mark Fermor, founder of Firevault, said: "Three decades of subscriber records sitting behind a permanently connected reference service is a very large amount of data kept reachable for a very small amount of daily need. The question every force and every public body should be asking is not how to defend everything, but which records have no reason to remain permanently reachable at all." [Offline Secure Storage®](/offline-secure-storage) answers that question at Layer 1. Records placed in an offline vault are physically disconnected at the hardware level, so they cannot be scanned, read, altered, encrypted or exfiltrated by an attacker who already has a foothold in an online estate. Subscriber and personnel directories, historic case material, archived legal reference sets and governance papers do not need a permanent network path in order to be useful. For public sector environments where operational systems must stay online, [Firevault Control](/control) provides the physical isolation layer around the data those systems depend on. Disconnect to Protect®. ## Sources - Computing, ["UK police legal database breach exposes details of more than 100,000 officers and staff"](https://www.computing.co.uk/news/2026/security/uk-police-legal-database-breach-exposes-details-of-more-than-100-000-officers-and-staff), 4 August 2026 - BleepingComputer, ["ExfilSquad hackers leak info of over 100,000 UK police officers, staff"](https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/) - PNLD, [official incident statement](https://www.pnld.co.uk/) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. [![Firevault Bunker, the protected physical location for Offline Secure Storage hardware](/__l5e/assets-v1/75208f4e-fc6f-46d8-80b9-606c43dfef28/firevault-bunker-building.webp)](/why-oss) The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) [![The nine Control modules arranged around the Firevault platform](/__l5e/assets-v1/829a8768-a871-41d0-8a79-3645ca7f5e83/platform-wheel.jpg)](/solutions/control) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) [![Firevault 2TB Vault hardware](/__l5e/assets-v1/ed09bfc1-2f0f-491d-b1aa-861542a5fb33/hero-vault-2tb.png)](/get-started) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful [ ![Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later](/news/hcrg-care-group-children-records-cyber-attack-2026.jpg) Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min ](/news/hcrg-care-group-children-records-cyber-attack-2026)[ ![FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters](/news/us-coast-guard-tanker-cyberattacks-2026.jpg) Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min ](/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026)[ ![FBI investigates 153 million drivers licenses put up for sale on a criminal forum](/news/fbi-drivers-licenses-dark-web-2026.jpg) Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min ](/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026)[ ![CenterPoint Energy confirms hackers stole customer data through an exposed API](/news/centerpoint-energy-cyberattack-2026.jpg) Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min ](/news/centerpoint-energy-confirms-cyberattack-data-theft-2026)[ ![Southampton council reported seven serious data breaches in a year, including a lost notebook with 224 residents' details](/news/southampton-council-data-breaches-2026.jpg) Breach Analysis ### Southampton council reported seven serious data breaches in a year, including a lost notebook with 224 residents' details Southampton City Council referred seven incidents to the Information Commissioner's Office in 2025/26, including a social worker's lost notebook containing the names, addresses and key safe numbers of 224 people. Mark Fermor on what a notebook, a miscatalogued archive and a curious officer tell us about the data organisations still cannot control. 16 Sept 2026 5 min ](/news/southampton-council-seven-serious-data-breaches-2026)[ ![Southport court files breach: the access was authorised, the purpose was not](/__l5e/assets-v1/8c5ecf7a-e4db-4dcb-b6dd-3585f89078ee/southport-court-files-insider-access-2026.jpg) Breach Analysis ### Southport court files breach: the access was authorised, the purpose was not The Ministry of Justice has confirmed that courts staff accessed files relating to victims, survivors and families of the Southport attack without authorisation. It is the third insider access case connected to the attack, and it shows why perimeter security alone cannot protect the most sensitive records. 16 Sept 2026 5 min ](/news/southport-court-files-insider-access-breach-2026) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/how-it-works/offline-secure-storage) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)