Police 'at serious risk' as more than 100,000 officers and staff have details leaked on 'dark web'

More than 100,000 police officers and staff have had their personal details leaked on the "dark web" following a major hack.

Hackers targeted the police national legal database (PNLD), a system that offers legal guidance to forces across England and Wales.

They also compromised data held by the Ministry of Defence, the Home Office, the National Crime Agency and the Crown Prosecution Service.

The massive breach now means three Government departments have now been hit by cyberattacks in a matter of days, following last week's breach at the Department for Education, which saw over half a million pieces of data exposed.

The PNLD breach, initially reported last week, was originally not considered serious - but now, officers' full names and contact details have been spilled into the murkiest depths of the web.

A cybercriminal outfit called ExfilSquad is thought to be behind the attack.

Police sources told The Times that 114,000 PNLD subscribers had their details exposed, the vast majority being officers.

And the full names and contact information for 2,615 CPS staff, 617 Home Office employees, 588 NCA personnel and 402 MoD workers were also released.

A further 21,000 email addresses belonging to members of the public who used the Ask the Police website were also published, though no passwords or security credentials appear to have been compromised.

One official affected by the leak said: "I have worked in serious organised crime and put high-level criminals behind bars. For private information to be leaked about me is very disconcerting and puts officers at serious risk.

"In the past I have been forced to move into safe houses and sell cars due to my job.

"Now I will have to keep my wits about me online and look out for anyone trying to get more serious information. It is not a good look."

The group has breached several western targets in recent weeks and is believed to be motivated by money rather than ideology.

ExfilSquad first drew attention after The Times brought the DfE hack - which put 607,000 pieces of sensitive data onto the dark web - to light.

READ MORE ON BRITAIN'S POLICE:

• Sadiq Khan spending tens of thousands in taxpayer cash for ‘diverse individuals’ to teach Met Police
• Henry Nowak's arresting officers under investigation over conduct prior to his death
• Taxpayers 'taken for fools' as report details how DEI policing costs smash £631m in just six years

A statement from the group online read: "Once your company's data is posted here, it's NEVER leaving the public eye and it will be passed around the internet FOREVER.

"The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay."

Tiff Lynch, the chairwoman of the Police Federation, said: "This reported breach raises serious concerns for officer and staff safety.

"At a time when cyber threats are becoming increasingly sophisticated, [the police] and its partners must be properly funded to ensure the strongest possible cyber security protections are in place to safeguard sensitive personal data."

Jake Moore, a global security adviser at Eset, said: "Unfortunately Government organisations are being seen as softer targets because they have not invested enough to properly protect private information."

Mr Moore also warned: "The information put on the dark web should not be underestimated.

"More experienced threat actors see it as highly valuable because it enables them to personalise follow-up attacks, such as phishing or social engineering, which puts even more data at risk."

Newcastle University has separately launched an inquiry after ExfilSquad allegedly stole 440,000 pieces of sensitive data, including names, phone numbers and home addresses of students and staff.

A Government spokesman said: "We have dedicated capabilities to respond to cyber incidents, and it would be inappropriate to comment on a live investigation."

An NCA spokesman said: "We are aware that limited personal details relating to a number of National Crime Agency officers may have been published on the dark web as a result of the incident affecting the police national legal database."

Our Standards: The GB News Editorial Charter