The Police National Legal Database (PNLD), a critical legal reference system serving all 43 Home Office police forces across England and Wales, has confirmed a security breach resulting in the exposure of personnel contact information. The incident also impacted 'Ask the Police,' a public-facing Q&A service managed on the same platform. According to Security Affairs, unauthorized actors managed to exfiltrate names, organizational affiliations, and work email addresses, which were subsequently published on the dark web.

While the scope of the affected user base remains unconfirmed by the PNLD, the organization handles a massive volume of registrations, highlighting the potential gravity of the exposure. Fortunately, preliminary analysis indicates that no passwords or sensitive security credentials were involved. The breach poses a twofold risk: police officers face an increased threat of targeted phishing attacks, and members of the public who utilized the 'Ask the Police' portal have had their engagement with law enforcement made public on criminal forums.

In response to the intrusion, the PNLD has launched a comprehensive investigation alongside the National Crime Agency (NCA) and external cybersecurity specialists. All relevant organizations have been alerted, and the matter has been formally reported to the UK Information Commissioner’s Office (ICO). While the extortion group ExfilSquad claimed responsibility for the leak in late July, researchers have noted that the breach architecture bears hallmarks of misconfigured Microsoft Power Pages, a common vulnerability in recent campaigns. The PNLD has clarified that the compromised system is not a criminal recording database and does not store sensitive details regarding victims, witnesses, or active criminal suspects.