Full Report
The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and customers. The incident, identified on July 26, also exposed some names
Analysis Summary
# Incident Report: PNLD Data Breach and Dark Web Leak
## Executive Summary
The Police National Legal Database (PNLD) suffered a data breach resulting in the exposure of contact information for UK police, government partners, and citizens on the dark web. The breach, attributed to the threat group **ExfilSquad**, likely stemmed from a misconfiguration in Microsoft Power Pages. While legal and contact data were compromised, PNLD confirms that no sensitive crime records or victim/witness data were held within the affected system.
## Incident Details
- **Discovery Date:** July 26, 2026
- **Incident Date:** Ongoing/Identified July 26, 2026
- **Affected Organization:** Police National Legal Database (PNLD)
- **Sector:** Law Enforcement / Government Services
- **Geography:** United Kingdom
## Timeline of Events
### Initial Access
- **Date/Time:** Prior to July 26, 2026
- **Vector:** Likely exploitation of misconfigured Microsoft Power Pages/Dataverse.
- **Details:** Attackers exploited "Anonymous User" permissions on a public portal, allowing unauthenticated access to backend Dataverse tables.
### Lateral Movement
- **Details:** Based on the methodology of ExfilSquad, the movement was likely limited to direct querying of the Dataverse Web API once the misconfiguration was identified.
### Data Exfiltration/Impact
- **Details:** Exfiltration of names, organizations, and work email addresses. Data included contacts for police officers, staff, criminal justice professionals, and individuals who used the "Ask the Police" service.
### Detection & Response
- **July 26, 2026:** PNLD identifies the breach; ExfilSquad lists PNLD on their dark web leak site.
- **August 3, 2026:** PNLD issues a public notice and confirms the scope of data exposed.
- **Ongoing:** PNLD collaborates with the NCA, ICO, and cybersecurity specialists.
## Attack Methodology
- **Initial Access:** Misconfiguration of Microsoft Power Pages (Public portal access).
- **Persistence:** Not disclosed; likely transient API access rather than persistent shells.
- **Privilege Escalation:** Exploitation of broad "Anonymous User" roles.
- **Defense Evasion:** Use of legitimate API routes (OData/Web API) to blend with normal traffic.
- **Credential Access:** PNLD states no evidence of password or credential compromise.
- **Discovery:** Scanning for exposed `content.powerapps.com` assets.
- **Collection:** Automated querying of Dataverse tables.
- **Exfiltration:** Direct download of records via the Web API.
- **Impact:** Data leak and reputational damage.
## Impact Assessment
- **Financial:** Costs associated with forensic investigation and NCA/ICO regulatory engagement.
- **Data Breach:** Compromise of professional contact details and citizen inquiries (Ask the Police).
- **Operational:** No disruption to police operations as PNLD is an information database, not a crime-recording system.
- **Reputational:** High; increased risk of targeted phishing/social engineering against law enforcement personnel.
## Indicators of Compromise
- **Network indicators:** Traffic to/from `content.powerapps.com` (defanged) associated with PNLD assets.
- **Behavioral indicators:** Excessive or anomalous querying of the `/_api` interface or OData feeds by unauthenticated IP addresses.
## Response Actions
- **Containment:** Likely restricted Anonymous User permissions on the Power Platform.
- **Eradication:** Review of all Power Pages table permissions and Web API settings.
- **Recovery:** Notified affected organizations and "Ask the Police" users with guidance. Notification of the Information Commissioner's Office (ICO).
## Lessons Learned
- **Permission Oversight:** Default settings or broad "Anonymous" roles in low-code/no-code platforms (Power Platform) can lead to mass data exposure.
- **Phishing Risk:** Even "non-sensitive" data like work emails can be weaponized for high-impact social engineering against government officials.
## Recommendations
- **Disable Anonymous Access:** Implement tenant-level governance controls to block unauthenticated reading of Dataverse data.
- **API Audit:** Regularly review enabled Power Pages Web APIs and legacy OData feeds.
- **Validation:** Perform unauthenticated browser testing to verify that backend tables are not reachable by the public.
- **User Education:** Brief police staff on the heightened risk of sophisticated phishing following the leak of their work email addresses.