Over 100,000 UK Police and staff have personal data leaked in attack on national database

UK’s Police National Legal Database (PNLD) breach leaks data of 100k+ criminal justice professionals
Threat group ExfilSquad claimed responsibility, posting 1.9 GB of stolen records on the dark web and demanding ransom
PNLD notified NCA and ICO, hired specialists, and confirmed passwords weren’t compromised but contact details exposed

The UK’s Police National Legal Database (PNLD) suffered a cyberattack recently, in which it allegedly lost sensitive data on more than 100,000 criminal justice professionals.

In a short press release, PNLD confirmed the breach, saying it happened over a weekend. The threat actors, which were not named in the announcement, were said to have taken names, organizations, and work email addresses belonging to police officers, staff, government partners, and customers.

The announcement also said the stolen information was already published on the dark web, adding that there is “no evidence to suggest that passwords or other security credentials have been compromised.” How the attackers worked their way in was not disclosed in the announcement.

ExfilSquad takes the blame

Following the breach, PNLD hired cyber-security specialists, and notified the National Crime Agency, which started their investigation into the incident.

“All affected organizations were contacted in the days following the incident and provided with further information and guidance,” the announcement reads. “The Information Commissioner’s Office (ICO) has also been notified.”

At the same time, threat actors calling themselves ExfilSquad claimed responsibility for the attack, BleepingComputer reported. The group alleges it stole 135,000 contact records, sharing samples to support their claims. They also said they demanded a ransom in exchange for keeping the data safe.

In the dark web post, ExfilSquad said it obtained 1.9 GB of data, which includes information belonging to 114,000 PNLD subscribers and 21,000 Ask the Police users.

‘Ask the Police’ is a public-facing website where users can find answers to hundreds of commonly asked policing or legal questions.

ExfilSquad is a relatively new threat actor that’s not known for any major attacks so far. Prior to the PNLD incident, it claimed the attack against Analog Devices, a US semiconductor company.