Police legal database hacked: 100,000 officers' details posted on the dark web

Around 100,000 UK police officers and police staff have had their names, contact details and force affiliations published on the dark web following a breach of the Police National Legal Database, the online legal resource used by Home Office forces across the country.

Staff at the Ministry of Defence, the Home Office, the National Crime Agency and the Crown Prosecution Service are also reported to be among those exposed.

What has been confirmed

The breach concerns the Police National Legal Database, known as the PNLD — a subscription legal reference service used by officers and police staff rather than an operational intelligence system. The data reported to have been taken is personal and organisational: names, contact details, and which force each person belongs to.

The cybercriminal group ExfilSquad is believed to be responsible. The breach is being reported as part of a wider run of attacks on Western public institutions, following a compromise at the Department for Education that exposed more than 500,000 records days earlier.

One member of police staff, quoted anonymously, said: "I have worked in serious organised crime and put high-level criminals behind bars. For private information to be leaked about me is very disconcerting and puts officers at serious risk."

What has not been confirmed

No force-by-force breakdown has been published. There are 145,550 full-time officers across England and Wales, and the Metropolitan Police is by some distance the largest force, but the number of London officers among the 100,000 has not been stated by anyone and we are not going to estimate it.

No named official from the Home Office, the National Police Chiefs' Council or the Metropolitan Police had commented at the time of writing. Attribution to ExfilSquad rests on reporting rather than on a confirmed law enforcement finding.

Why the type of data matters

The PNLD is a legal reference tool, not a case management or intelligence system, so the exposure reported here is of who officers are and where they work rather than of the investigations they are conducting.

That distinction matters and it does not make the exposure minor. For officers working on organised crime, counter-terrorism or covert operations, the association between a name and a force is itself the sensitive fact. It is the reason the risk described by the officer quoted above is about personal safety rather than about compromised casework.

What officers can do now

Affected staff should expect their own force to make contact directly, and any approach that arrives first by email or text asking for credentials should be treated as suspect — a leak of contact details is a phishing opportunity before it is anything else.

We will update this report when the Home Office, the National Police Chiefs' Council or the Metropolitan Police make a statement, and if a force-level breakdown is published.