A Watchdog Report That Raises More Questions Than It Answers
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services published a report this week confirming that hackers have repeatedly breached third-party suppliers holding British police data going back to 2021. The Police Digital Service and the National Police Chiefs' Council shared details of multiple attacks against third-party ICT supply chains with inspectors, under conditions that kept most of the operational substance out of public view. What the public report does not include is almost everything that would let anyone outside government assess the real scale of the problem: no count of attacks, no names of affected suppliers or forces, and no confirmation of whether data was actually stolen in any of the incidents referenced.
The inspectorate says it removed operational details it judged unsuitable for public release, a defensible call while investigations stay active but one that leaves taxpayers and oversight bodies with a confirmed problem and no real way to measure its true size. The Home Office and the National Police Chiefs' Council did not respond to questions about whether police data had actually been compromised in any of these supplier incidents, which is its own kind of answer worth noting.
The Numbers We Do Have Are Already Alarming
Even with the redactions, the figures that did make it into the report are striking on their own and give a sense of the baseline activity level. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of the year alone, alongside 796 near misses where no harmful data or system breach resulted. The incidents spanned malware, unauthorized access attempts, and accidental disclosures by staff, and the report does not specify how many of the 252 involved confirmed data loss versus contained attempts.
Extrapolated across a full year, that incident rate describes an environment under sustained, ongoing pressure rather than one absorbing the occasional breach as a rare exception. Leaders in both policing and fire services told inspectors that further attacks were 'highly likely' in the period ahead, a phrase that reads less like routine caution and more like an institutional acknowledgment that the current posture is not holding up under the volume these services are now facing.
Why Supplier Risk Is Different for Police Data
The Police Digital Service itself identified supplier-held data as among the sector's biggest risks, precisely because it sits outside the service's own monitoring and control. That risk is sharpest for the categories of data that carry the most harm if exposed: information on victims, safeguarding cases, intelligence, and active investigations that are often still open. Unlike a retail loyalty database, this is data where exposure can directly endanger the physical safety of the people it describes, not just their privacy or finances.
The report found that most police supplier contracts had no ongoing cybersecurity assurance built into them at all, beyond whatever baseline existed at the point of signing. Some staff could not even say whether their suppliers were contractually required to report incidents promptly once discovered. Supplier system logs were often not routinely visible to in-house police IT teams, meaning a breach at a vendor could persist for an unknown period before anyone on the police side would even know to go looking for one.
A Policy Gap Nobody Can Explain
Perhaps the most pointed finding in the report is procedural rather than technical: policing and fire services were left out of the National Risk Register 2025, the Government Cyber Action Plan published in January, and the Cyber Security and Resilience Bill currently working through Parliament. These are the main instruments the UK government uses to set national cybersecurity priorities and funding obligations, and emergency services were absent from all three despite running some of the most sensitive data in the country.
No official interviewed by inspectors could explain why that omission happened or persisted this long. That is a governance failure sitting above any individual supplier breach, and arguably a more important one to fix. It suggests that the sector's cyber risk has not been formally registered at the level where national policy and funding decisions actually get made, regardless of how real the operational risk clearly is to anyone looking at the incident numbers on the ground.
The Pattern Behind the Redactions
The report cites a string of publicly known incidents that illustrate the pattern even without the full count. A 2023 ransomware attack on ID card maker Digital ID exposed details of Metropolitan Police officers and staff and led to the theft of thousands of Greater Manchester Police officers' names and photos. More recently, the Police National Legal Database, run by West Yorkshire Police and used by every force in England and Wales, confirmed hackers stole contact details of officers and staff.
Dyfed-Powys Police disclosed a separate cyberattack that disrupted non-emergency systems and may have compromised staff information. Dutch police blamed a likely state actor for a comparable breach of officers' contact details in 2024, and the FBI has said hackers, suspected to be linked to China, accessed a network holding wiretap data through a third party. The common thread across every one of these cases is the same: the breach happened at a vendor, not inside the police force itself.
What This Means for Any CIO Who Outsources Sensitive Data
The decision this report puts in front of every technology leader, in policing or anywhere else, is whether vendor cybersecurity assurance is a one-time procurement checkbox or a standing operational discipline. The specific failures the inspectorate found, contracts with no ongoing assurance clauses, unclear incident reporting obligations, and supplier logs invisible to the customer, are not unique to UK policing. They describe the default state of most vendor relationships until someone forces a change.
Michelle Skeer's line to inspectors, that 'a major cyberattack is not a hypothetical scenario,' is the sentence worth carrying into your own vendor risk review. Any organization holding data whose exposure would cause real harm, whether that is victim records, patient data, or customer financial information, should be able to answer the same questions this report could not: how many supplier incidents occurred this year, and would anyone on the customer side actually know if one happened tomorrow.
