Cyberattacks Hit Police Data Suppliers, Inspectors Say

Cyberattacks between 2021 and 2025 compromised IT suppliers holding police data, the inspectorate for police forces and fire and rescue services has found. In none of them was a police system attacked directly.

His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published the findings on 27 October in a report on cybersecurity in police forces and fire and rescue services. It says most police supplier contracts had no ongoing security checks, and that both sectors are missing from the government’s main cyber plans. It makes 13 recommendations.

In brief

The Police Digital Service (PDS) recorded 252 cybersecurity incidents and 796 near misses in policing between January and March 2026.
The report says supply chains holding police information were compromised in several attacks, but does not say how many, which suppliers, or whether data was stolen.
Inspectors want supplier contracts reviewed by May 2027 and baseline security standards across both sectors.

What the inspectors found about suppliers

The PDS and the National Police Chiefs’ Council “shared information on multiple cyberattacks that happened between 2021 and 2025 in which police data was at risk”, the report says. “None involved a direct attack on police ICT systems. Worryingly, it was the third-party ICT supply chains which held police information that had been compromised.” The police dealt with each one as a critical incident, it adds.

The public version leaves out operational detail. HMICFRS says the full findings included matters “that weren’t suitable for the public domain”, so it published a version with them removed. The report does not name the suppliers or forces involved, or say whether any data was taken.

The PDS told inspectors that police data held on suppliers’ systems was “one of the most significant cybersecurity risks to policing”, because those systems sit outside its protective monitoring. That data can include information about victims, safeguarding, intelligence and ongoing investigations.

Yet the checks on suppliers were thin. “Most of these third-party contractual arrangements didn’t include any ongoing cybersecurity assurance arrangements,” the report says. All six organisations inspected, three police forces and three fire and rescue services, relied on suppliers, and “none of them had comprehensive processes that were robust enough to assure their suppliers’ cybersecurity”. Assurance “relied heavily on supplier self-certification”. Some staff could not confirm whether a supplier had to tell them promptly about a cybersecurity incident. Where suppliers hosted systems, logging was “limited and/or not shared”.

Incidents, near misses and legacy systems

The PDS counted 252 cybersecurity incidents and 796 near misses affecting policing between January and March 2026. The report defines a near miss as an incident with “no harmful data or ICT systems breach”. The incidents included malware, attempts to reach police systems without the right authorisation, and accidental but unauthorised disclosures by police staff. The report gives no further breakdown.

“Many leaders told us that further attacks were highly likely,” the inspectors write. Leaders in both sectors named legacy IT as their highest strategic cybersecurity risk, and every organisation inspected relied on it to some degree. Inspectors also found weak controls on staff joining, moving and leaving, poor password management and, in some organisations, a lack of multi-factor authentication. A similar failure, a forgotten test account protected by “Password1”, let ransomware into a Welsh public-sector data body, as the ICO’s reprimand set out last week.

“The cyber threat to police forces and fire and rescue services is significant and expanding rapidly,” said Michelle Skeer, His Majesty’s Inspector of Constabulary and of Fire & Rescue Services. “A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix.”

Left out of national plans

The report criticises the government as well as forces. Policing and fire are not mentioned as a cyber risk in the National Risk Register 2025. The Government Cyber Action Plan, published in January 2026, covers central government only. “No government cybersecurity stakeholder that we interviewed could explain why policing and the fire and rescue sector were excluded from the action plan,” the inspectors write.

The Cyber Security and Resilience Bill, introduced in November 2025 and still before Parliament during the inspection, would bring some suppliers, such as managed service providers and larger data centres, into scope. HMICFRS calls that helpful. But the bill sets no specific rules for policing or fire. Asked why, government cyber leaders could not say, according to the report.

Why the fixes start with contracts

The supplier findings matter most because they describe a gap that forces cannot close by securing their own networks. If a supplier’s systems are not secure, “neither is the data held within them”, the report says. Its most concrete fixes target that gap. By May 2027, every chief constable in England and Wales should review police IT contracts and procurement, improve those without adequate cybersecurity assurance, and adopt the government’s Secure by Design principles and the PDS’s Third-Party Assurance for Policing standards. Chief fire officers in England are asked to ensure, by the same date, that new or renewed contracts meet Cyber Essentials and Secure by Design.

Those steps target the weaknesses the inspectors listed: checks that were strong at procurement but faded, contracts that varied on breach-reporting timescales and access to logs, and layered supply chains where nobody was clearly responsible. The report links them to real disruption: several organisations it inspected had seen slow supplier notification after incidents and could not reach logs needed for incident response.

The report also asks for measurable baselines. Every police force should reach at least level 3.0 on the Security Assessment for Policing framework by September 2028, and every English fire service should meet the baseline of the National Cyber Security Centre’s Cyber Assessment Framework by November 2027. Police chiefs are urged to make more use of the PDS National Management Centre, which monitors threats across policing. Fire has no equivalent, which the inspectors say puts it at greater risk.

The national gaps are harder to fix with contracts alone. Police forces are category 1 emergency responders, yet the NIS regulations that cover energy, water and the health sector exclude them. The report notes that the bill would give ministers powers to regulate police and fire cybersecurity later through secondary legislation. Whether ministers use them is the real test. The threats are not abstract: this month Symantec said Russian state hackers had reached a law enforcement agency in a NATO country, and a minister said 32 UK government services were offline over PHP flaws, largely as a precaution.

What happens next

The first deadlines fall in February 2027, when the Ministry of Housing, Communities and Local Government is asked to encourage fire services to adopt the Cyber Assessment Framework and review how it oversees fire and council cybersecurity. Police contract reviews and work with the NCSC and other national bodies are due by May 2027. Leadership training for both sectors is due by November 2027.