ExfilSquad hackers leak info of over 100,000 UK police officers, staff

Summary

The Police National Legal Database (PNLD), used by 43 UK Home Office police forces and British Transport Police, suffered a cyberattack exposing contact details of over 100,000 police officers and criminal justice professionals. The ExfilSquad data extortion group claimed responsibility, alleging theft of 1.9 GB including 135,000 records (114,000 PNLD subscribers and 21,000 Ask the Police users), and demanded ransom. The breach, detected July 26, 2026, exposed full names, organizations, and email addresses, but no passwords or sensitive victim/witness data were compromised.

Full text

ExfilSquad hackers leak info of over 100,000 UK police officers, staff By Bill Toulas August 3, 2026 11:04 AM 0 A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. The intrusion was detected on Sunday, July 26, and was later claimed by the ExfilSquad data extortion group, which alleges it stole 135,000 contact records. PNLD is an online legal resource service that has been used for more than 30 years by the 43 Home Office police forces in England and Wales, as well as the British Transport Police. PNLD also operates ‘Ask the Police,’ a public-facing website with answers to hundreds of common policing and legal questions. In a statement today, the service says that the breach exposed the full names, organizations, and email addresses of police officers, staff, criminal justice professionals, and government partners. Also considered compromised are the names and email addresses of Ask the Police users who submitted a question through the platform. The incident is now being investigated with assistance from cybersecurity experts and the National Crime Agency (NCA). No evidence has been found that passwords or other security credentials have been compromised. PNLD does not hold confidential information relating to victims, witnesses, or offenders, and says no such data was impacted. “All affected organizations were contacted in the days following the incident and provided with further information and guidance. The Information Commissioner’s Office (ICO) has also been notified,” PNLD says. ExfilSquad claims 135,000 records The ExfilSquad data extortion group claimed responsibility for the attack on PNLD and published sample data to support its claims. The threat actor also demanded a ransom in exchange for not releasing the remaining stolen data. ExfilSquad claims to have stolen 1.9 GB of data from PNLD, including approximately 135,000 records. According to the group, the data consists of information belonging to 114,000 PNLD subscribers and 21,000 Ask the Police users. ExfilSquad leak of PNLD dataSource: BleepingComputer ExfilSquad is the same threat actor that recently claimed an attack on American semiconductor company Analog Devices. PNLD has confirmed the breach and publication of contact details but has not publicly attributed the intrusion or disclosed how attackers gained access. BleepingComputer has contacted PNLD to ask for more details about the incident and will update the article when we receive a reply. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Coca-Cola confirms data theft in Fairlife ransomware attackNAIC says public data stolen in ShinyHunters' PeopleSoft breachAnalog Devices discloses data breach, says operations unaffectedErnst & Young data breach claimed by ShinyHunters extortion gangDentaQuest data breach exposed info of 2.6 million accounts

Indicators of Compromise

• malware — ExfilSquad

Entities