Breach of Britain's PNLD: Police Contacts Leaked to the Dark Web

The UK's Police National Legal Database (PNLD) — the service that supplies all 43 Home Office police forces and criminal justice organisations with legal information — has reported that contact details were compromised. The stolen information ended up published on the dark web.

What leaked

The posted data contains the names, organisation names and work email addresses of police officers, civilian staff, criminal justice professionals, government partners and clients. The incident was detected on 26 July. Some users of the Ask the Police service were also affected — their names and addresses appeared in the leak too.

According to UK authorities, it is precisely this pairing (a specific officer's name plus their email) that makes phishing messages more convincing. PNLD stresses that there is no sign of any compromise of passwords or other credentials. It also matters what PNLD is not: it is not the Police National Computer, nor the Police National Database; it does not record crimes and does not store confidential information about victims, witnesses or suspects.

Few details in the open

As of 3 August, PNLD had still not disclosed how many people were affected, when the intrusion began, how long the access lasted, or how much data was stolen. For comparison: the 2025-26 annual report mentions 108,429 police registrations, but that is the size of the audience, not the number of breach victims.

The service has notified the regulator, the ICO, is working with the National Crime Agency and specialist cybersecurity experts, and has contacted all the organisations affected.

The Power Pages theory

It is known that PNLD is built on the Microsoft Power Platform, and the notification page linked to resources on the content.powerapps.com domain. This confirms the connection to the platform, but does not explain exactly how the attacker obtained the data.

Analysts at VenariX examined samples for 11 of the 15 victims claimed by the ExfilSquad group, and in every case found structures characteristic of Dataverse. The most likely scenario, in their assessment, is a public Power Pages site with overly broad anonymous-user access to Dataverse tables via the Web API or a legacy OData channel. In one case a public portal did indeed return records without any authentication at all.

But as it applies to PNLD specifically, this remains a hypothesis for now: neither the notification nor the VenariX report names a specific vulnerable endpoint or setting. No signs of ransomware, malware, lateral movement or exploitation of a vulnerability were found in the material examined. ExfilSquad added PNLD to its leak site on 26 July, but PNLD itself does not officially attribute the attack to that group.

Source: The Hacker News