Work email addresses and names tied to UK police officers, police staff, criminal justice professionals, government partners and customers have been published on the dark web, according to the Police National Legal Database (PNLD). The body says it detected the leak on July 26.
People who had sent questions via the Ask the Police service were also caught in the exposure. Officials warn the leaked detail gives phishers a credible hook for targeting named officers.
PNLD moved to contain the fallout, stressing the database is neither the Police National Computer nor the Police National Database, is not a crime-recording system, and contains no confidential records on victims, witnesses, or offenders. It also stressed that no passwords or security credentials were compromised. Affected organisations have been contacted, the Information Commissioner’s Office has been notified, and the National Crime Agency plus specialist security firms are involved in the response.
Researchers at VenariX examined samples tied to 11 of the 15 victims claimed by a group known as ExfilSquad and found structures consistent with Microsoft Dataverse. VenariX pointed to a public Power Pages portal that granted wide Anonymous Users access to Dataverse tables with the Web API switched on as the probable campaign-level path. Microsoft documents that granting the Anonymous Users role table access exposes data to any visitor.
PNLD has not said how many people were affected, when access began or how long it lasted. VenariX stresses the Power Pages link remains unproven for PNLD specifically and advises portal operators to review Anonymous Users permissions, Web API settings and legacy OData feeds, then verify what an unauthenticated browser can read.
