Hackers have repeatedly compromised outside technology suppliers that hold police information in England and Wales since 2021, the inspectorate that oversees policing found in a report published Tuesday, The Record reported. The finding makes police data a case study in third-party risk and adds pressure on a government that left policing and fire services out of its main cyber legislation.
What Happened
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) concluded that police forces and fire and rescue services are not fully prepared for a growing cyber threat, according to The Record. Information on the supplier attacks came from the Police Digital Service, a government-created body that runs a national security operations center, and the National Police Chiefs' Council (NPCC).
The report does not say how many supplier attacks occurred, which suppliers or forces were hit, or whether data was stolen; the inspectorate said it removed operational details it judged unsuitable for publication. The Home Office and the NPCC did not answer The Record's questions about whether police data was compromised.
The Police Digital Service told inspectors that police data on suppliers' systems is among the sector's biggest risks because it sits outside the service's monitoring. The danger is greatest for information about victims, safeguarding, intelligence and investigations.
Most supplier contracts included no ongoing cybersecurity assurance, meaning no continuing checks that a supplier keeps its defenses in order. In several organizations, in-house teams did not routinely see suppliers' system logs.
The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 near misses, which the report defines as incidents with no harmful breach of data or systems, The Record reported.
"A major cyberattack is not a hypothetical scenario," Michelle Skeer, one of His Majesty's inspectors of constabulary, said, according to The Record.
Why It Matters
The inspectorate faulted the government for leaving policing and fire out of the National Risk Register 2025, the Government Cyber Action Plan published in January and the Cyber Security and Resilience Bill, which is still before Parliament. No official could explain the omissions, which the report called concerning. The Primary Wire reported Oct. 15, citing The Register, that officials had not yet decided whether to use the same bill to address AI risks.
For leaders, the lesson travels: data handed to contractors is only as protected as the contract requires and the client can verify. U.S. public-safety agencies face the same exposure; The Record noted the FBI said this year that hackers reached a network holding wiretap data through a third party.
What to Watch
Watch whether ministers add policing and fire to the Cyber Security and Resilience Bill, whether the Home Office or NPCC disclose which suppliers were hit and whether data was taken, and whether forces write ongoing security checks into supplier contracts.
