A 30-year-old legal database becomes a leak site listing
The Police National Legal Database has run for three decades as the reference tool every Home Office police force in England and Wales uses to look up legislation, case law, and procedural guidance. It is not a crime-recording system and never held victim or offender data. That distinction matters for the scale of harm here, but it did not stop ExfilSquad, a data extortion group, from listing PNLD on its leak site on July 26 and publishing a sample of what it claims is 1.9 GB of stolen data covering roughly 135,000 records.
PNLD confirmed the breach on August 3 and split the numbers into two buckets: about 114,000 subscriber records tied to police officers, staff, and criminal justice professionals, plus around 21,000 records from Ask the Police, a public-facing Q&A service running on the same platform. The organization notified the UK's Information Commissioner's Office, brought in outside cybersecurity investigators, and looped in the National Crime Agency. Its public statement leans on one reassurance: no passwords or credentials were part of the haul, only names, work emails, and organizational affiliations.
The access path researchers found looks uncomfortably routine
The mechanism matters here more than the headline record count. Security firm VenariX reviewed PNLD's own 2023-24 technology summary and found confirmed use of Microsoft's Power Platform. Based on that and the shape of the leaked data, VenariX describes a likely chain: a public-facing Power Pages portal, an Anonymous Users web role, a table permission set too broadly, and a Power Pages Web API or legacy OData feed that exports straight out of Dataverse. None of that requires a zero-day exploit or custom tooling. It requires someone accepting the default access settings on a low-code portal at launch and never revisiting them as the underlying tables filled up with real production data over months or years of routine use.
VenariX says this pattern is not unique to PNLD. Of the fifteen organizations ExfilSquad has claimed as victims, the firm reviewed eleven and found the same Dataverse-consistent structure across all of them. That turns this from an isolated incident report into evidence of a campaign against a specific class of misconfiguration, one that a low-code platform makes easy to create and easy to overlook. A scanner that can find one exposed Power Pages portal with an over-permissioned anonymous role can find hundreds, and the eleven-of-fifteen hit rate suggests ExfilSquad has automated exactly that search.
Why Power Pages specifically keeps producing this failure mode
Power Pages exists to let business teams build public-facing portals without waiting on a development sprint, and the platform's defaults reflect that priority. A new table connected to a portal can inherit permissions that were reasonable when the portal only served a simple contact form, and those permissions rarely get re-scoped when the table's purpose expands. Unlike a managed data warehouse, where a new schema typically triggers a review from whoever owns access governance, a Dataverse table added to an existing Power Pages site can go live without touching any of the review processes a data team has built for its core platforms.
That gap between how fast low-code tools let non-engineers ship and how slowly access governance processes typically move is the real vulnerability, and it is organizational as much as technical. PNLD's Ask the Police service almost certainly started as a simple public Q&A tool years before it sat on the same infrastructure as sensitive subscriber records. Nobody made a single reckless decision, the risk accumulated as the portal's scope grew past what its original permission model was designed to handle.
Low-code portals are databases now, whether you govern them as one or not
The pattern here is the part that should land with any data leader running a Power Platform, OutSystems, or similar low-code footprint alongside a governed warehouse. Power Pages was built to let business teams stand up citizen-facing portals fast, and it succeeds at that. What it does not do automatically is treat the Dataverse tables behind those portals with the same access review, anonymous-user scrutiny, and change control you would apply to a Snowflake schema or a Postgres instance holding the same category of data. A portal that started as an FAQ page for Ask the Police can end up, years later, sitting on top of tables containing staff contact records for every police force in the country.
That gap tends to open quietly. A portal launches under IT's watch, ownership drifts to a business unit, someone adds a table, and the anonymous access role that made sense for a public FAQ never gets scoped down as the schema grows. Data platform teams that maintain an inventory of governed data sources but treat low-code app data as out of scope are leaving exactly this kind of exposure unaudited. The fix is not exotic: table-level permission reviews on any Power Pages or Dataverse deployment, explicit blocks on anonymous write and export routes, and treating every low-code portal as a data asset subject to the same classification rules as the warehouse it eventually feeds.
What this means for anyone running an incident response playbook
PNLD's disclosure followed a reasonably tight sequence: identification on July 26, public confirmation and regulator notification within roughly a week, and coordination with a national law enforcement body from day one. For an organization serving every police force in two nations, that is the response pattern to hold up as adequate, not exceptional. The absence of credential theft narrows the immediate blast radius, but contact-level data on police officers and criminal justice staff is precisely the kind of information that feeds targeted phishing and social engineering campaigns for months after a breach fades from headlines.
The bigger signal for data leaders is upstream of any individual incident response. If eleven of fifteen victims in one extortion group's portfolio share the same Power Pages misconfiguration, that is a scanner-driven campaign, not opportunistic luck. Any organization running Power Pages in front of Dataverse should be auditing anonymous user roles and table permissions this week, not after their own name shows up on a leak site. The database governance conversation that data teams have been having about warehouses and lakehouses needs to extend to every low-code layer sitting quietly in front of them.
