Breaches · 55 days ago
Published names and work email addresses make impersonation easier. The usual breach response is to look for stolen passwords, but here the exposed directory data can be used to make fake messages look like they came from a real colleague, service desk, or government contact.
PNLD said its July 26 incident exposed contact details for police officers, police staff, criminal justice professionals, government partners, customers, and some Ask the Police users. It said there is no evidence that passwords or other security credentials were taken, and it has notified affected organizations and users.
For UK police, justice, and government teams that publish staff contact details, the risk now sits in the inbox. A public name plus a work address is enough to make spearphishing and credential-harvest attempts harder to spot.
2 sources covering this story
UK’s Police National Legal Database Reveals Data Breach
The UK’s Police National Legal Database and Ask the Police service have been breached
PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web
PNLD confirms police, government and customer contact data was published on the dark web, including names and emails from some Ask the Police users.
Part of the PlainSec briefing for 2026-08-05