Science & Tech · Cybersecurity · 3 hrs ago
UK watchdog finds repeated cyberattacks on police data suppliers
A UK watchdog found that hackers repeatedly breached suppliers holding police data since 2021.
The findings cover police forces in England and Wales and fire and rescue services in England.
The watchdog did not identify the suppliers or forces involved, say how many attacks occurred, or confirm whether data was stolen in those incidents.
Separately, the Police Digital Service recorded 252 cybersecurity incidents in the first three months of 2026, along with 796 near misses.
Inspectors found that many supplier contracts lacked regular cybersecurity checks, while police teams could not always see suppliers’ system logs.
The watchdog said this leaves sensitive information, including intelligence and investigation data, at risk and urged leaders to treat cybersecurity as a core priority.
It made 13 recommendations to strengthen protections, including common security standards, better supplier checks and more attack-response exercises.
A UK policing watchdog found that hackers have repeatedly breached third-party suppliers holding police data since 2021.
The report does not state how many attacks occurred, which suppliers or police forces were affected, or whether data was stolen in those incidents.
Inspectors found that most police supplier contracts had no ongoing cybersecurity assurance.
The watchdog made 13 recommendations to improve cybersecurity in police forces and fire and rescue services.
The report also recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, alongside 796 near misses.
- Who
- His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services reported the findings. Police data suppliers were repeatedly targeted.
- What
- The watchdog found repeated cyberattacks on third-party suppliers holding police data and called for stronger cybersecurity.
- When
- The supplier attacks have occurred since 2021. The report was published on October 27, 2026.
- Where
- The affected suppliers held British police data. The report covers police forces in England and Wales and fire and rescue services in England.
- Why
- The report says supplier-held police data is a major risk because it sits outside policing’s monitoring. It does not state why the attacks occurred.
This story does not have two clearly opposing sides.
The Police Digital Service was set up by the British government.
HMICFRS carried out a three-phase inspection involving interviews, reality testing and scrutiny of more than 260 documents.
The Police Digital Service recorded 252 cybersecurity incidents affecting policing and 796 near misses.
HMICFRS published its report on cybersecurity in police forces and fire and rescue services.
- Supplier attacks
- Repeatedly reported since 2021
- Police cybersecurity incidents
- 252 in the first three months of 2026
- Near misses
- 796 in the first three months of 2026
- Recommendations
- 13
- Supplier contracts
- Most had no ongoing cybersecurity assurance
3 sources
What people are saying
While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber-attacks
Cybersecurity should be viewed as a core organizational priority and not solely a technical risk.
Protecting systems and data is essential to protecting the public.