News and Analysis

The Police National Legal Database (PNLD) has confirmed that data stolen in a cyber attack last week has been published on the dark web. PNLD is an online criminal law database used by the 43 Home Office police forces of England and Wales, law enforcement, and wider criminal justice organizations.It is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders.The organization said the attack was detected on Sunday 26 July, since then it’s been working with specialist cybersecurity organizations and the National Crime Agency (NCA) to investigate what happened and take appropriate action.”Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web,” it said. “There is no evidence to suggest that passwords or other security credentials have been compromised.”Because the PNLD hosts the Ask the Police site, some names and email addresses of people who have in the past submitted a question have been published on the dark web.PNLD said it had contacted all affected organizations with further information and guidance, and that the Information Commissioner’s Office (ICO) has also been notified.”Compromised police data is a very serious breach and should be the final push needed to improve security and stop this from happening yet again,” commented Jake Moore, global cybersecurity advisor at ESET. “Government agencies have long been a soft target and continue to remain caught up in data breaches where sensitive information ends up being released. Even simple information like email addresses and location can put police staff at high risk of targeted phishing attacks that will be almost impossible to detect.”Who is behind the PNLD cyber attack?The attackers, ExfilSquad, listed PNLD on their leak site on 26 July. It’s the same group behind the recent breach of the Department for Education (DfE). Threat actors accessed more than 600,000 records including the names, job titles, and phone numbers of thousands of head teachers, university staff, and government officials via the DfE’s Help Desk Self-Service Portal and the Turing Scheme Portal.”ExfilSquad looks financially motivated rather than state-backed and is unlikely to see a payout given government’s strict no-ransom policy,” said Graham Taylor, director, defence strategy, for Northern Europe at OPSWAT. “The uncomfortable truth is that much of the UK’s public sector, with significant legacy systems and fragmented oversight, is years behind the resourcing and resilience needed to combat current and future cyber threats.”Departments need to implement secure file transfer technologies, alongside file inspection and malware scanning, to stop malicious payloads entering critical systems via trusted data exchanges, he said.FOLLOW US ON SOCIAL MEDIA