UK police legal database breach exposed officers’ names and work emails, increasing phishing risks. NCA is investigating.
The Police National Legal Database (PNLD), the legal reference system used by all 43 Home Office police forces in England and Wales, confirmed that a data breach exposed the contact details of police officers, staff, and criminal justice professionals and published them on the dark web. The breach also hit Ask the Police, a public Q&A service hosted on the same platform. The National Crime Agency is involved in the investigation.
“Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web.” reads the notice of data breach. “There is no evidence to suggest that passwords or other security credentials have been compromised.”
UK police is investigating the security breach with the help of the National Crime Agency (NCA) and private cybersecurity firms.
The PNLD reported 108,429 police registrations in its 2025-26 annual summary, which gives some sense of the potential user base affected, though PNLD has not disclosed how many individuals are actually in the breached dataset. No victim count, no timeline of when the intrusion began, no statement on how much data was taken.
“The data security incident primarily affected the Police National Legal Database (PNLD) which hosts the Ask the Police site.” continues the notice. “As a result, some names and email addresses of people who have previously submitted a question to Ask the Police have been published on the dark web.”
Ask the Police is a public-facing service where anyone can submit questions to the police. The exposure of those submitters’ names and emails alongside police officers’ work contact details creates two distinct risk categories: named officers are now more vulnerable to targeted phishing, and members of the public who contacted police services have had that fact made visible on criminal forums.
“PNLD also provides legal information, products and services to UK police forces and criminal justice organisations; it is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders.” concludes the notice.
All affected organizations were promptly notified, provided guidance, and the incident was reported to the UK Information Commissioner’s Office (ICO).
The extortion group ExfilSquad listed PNLD on its leak site on July 26, though PNLD has not attributed the incident to the group.
Cybersecurity firm VenariX reviewed samples associated with 11 of ExfilSquad’s 15 claimed victims and found structures consistent with Microsoft Dataverse across all of them, pointing toward a likely campaign pattern involving misconfigured Microsoft Power Pages portals, public-facing sites where overly permissive table access settings can expose data to anyone who visits the page without logging in.
PNLD’s 2023-24 annual summary stated the database uses Microsoft Power Platform technology, and the breach notice page references assets on Microsoft’s content.powerapps.com domain, which corroborates the platform connection. That said, neither PNLD’s notice nor VenariX’s report has confirmed a PNLD-specific endpoint, permission setting, or access route, the Power Pages hypothesis remains exactly that: a hypothesis consistent with the evidence, not a confirmed root cause.
“The reviewed data is most consistent with extraction from public Microsoft Power Pages portals that were configured to allow anonymous users to read Dataverse records.” states VenariX. “Microsoft documents that Power Pages can expose Dataverse tables through its portal Web API using the /_api/<EntitySetName> route, and that access is governed by table permissions assigned through web roles.
A likely flow is:
Public Power Pages portal → Anonymous Users web role → Broad table permission → Power Pages Web API or legacy OData feed → Dataverse data export“
For any organization running Microsoft Power Pages: VenariX recommends reviewing Anonymous Users table permissions, Web API settings, and legacy OData feeds, then validating access from an unauthenticated browser session. Microsoft provides a tenant-level control that blocks unauthenticated users from reading Dataverse data while still allowing public form submissions. That’s the kind of configuration that should have been validated before deployment, not after a breach.
Police officers and staff whose details were exposed should be alert to targeted phishing that uses their name, organization, and work email, the exact combination now available on the dark web.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, UK Police)
