Work email addresses and names tied to UK police officers, police staff, criminal justice professionals, government partners and customers have been published on the dark web, according to the Police National Legal Database (PNLD). The body says it detected the leak on July 26.
The exposure also hit some people who submitted questions through the Ask the Police service. Officials warn the leaked detail gives phishers a credible hook for targeting named officers.
PNLD sought to narrow the scope: the database is not the Police National Computer or the Police National Database, it is not a crime-recording system, and it holds no confidential material on victims, witnesses or offenders. It also stressed that no passwords or security credentials were compromised. Affected organisations have been contacted, the Information Commissioner’s Office has been notified, and the National Crime Agency plus specialist security firms are involved in the response.
Researchers at VenariX examined samples tied to 11 of the 15 victims claimed by a group known as ExfilSquad and found structures consistent with Microsoft Dataverse. The likely campaign-level route: a public Power Pages portal left broad Anonymous Users access to Dataverse tables with the Web API enabled. Microsoft documents that granting the Anonymous Users role table access exposes data to any visitor.
PNLD has not said how many people were affected, when access began or how long it lasted. VenariX stresses the Power Pages link remains unproven for PNLD specifically and advises portal operators to review Anonymous Users permissions, Web API settings and legacy OData feeds, then verify what an unauthenticated browser can read.
