Story perspectives

Hackers Leak 114,000 UK Police Emails via Power Platform Misconfiguration

8/6/2026

Summary

ExfilSquad Breaches PNLD

Cybercriminals breached the Police National Legal Database (PNLD) on July 26, 2026 and posted over 100,000 officers’ names and emails on the dark web.
Norfolk and Suffolk Constabularies confirmed officers in their forces were among those exposed, and a PNLD spokesperson said no passwords were compromised.
Cyber-security firms, the National Crime Agency and the Information Commissioner’s Office are aiding probe, and police sources say the hacking group ExfilSquad targeted 114,000 PNLD subscribers.

Summary

VenariX Flags Misconfig

VenariX traced the PNLD breach to a Power Pages portal exposing Dataverse tables to anonymous users, a configuration that PNLD’s report confirmed runs on Power Platform and linked to powerapps.com assets.
Analysis of 11 datasets showed Dataverse structures, suggesting extraction via the Web API or OData feed.
VenariX warned that granting the “Anonymous Users” role makes data readable, a condition Microsoft can block with a control should have been verified.

Summary

ExfilSquad Ransom

ExfilSquad posted an online ransom note demanding payment, calling the breach a “rounding error” compared with potential litigation costs.
Police Federation chair Tiff Lynch warned that the leak shows a need for increased cyber-security funding to protect officers.
Global security adviser Jake Moore of Eset cautioned that the exposed data could enable personalised phishing and social-engineering attacks.

History

Historical Context

In March 2014 the OPM network was first infiltrated, and the breach disclosed in June 2015 revealed that Chinese-linked hackers exfiltrated about 22.1 million federal personnel records, including SF-86 security-clearance data. The scandal forced OPM director Katherine Archuleta and CIO Donna Seymour to resign and prompted DHS and congressional oversight of federal cybersecurity.

1 of 4

ExfilSquad Breaches PNLD

Cybercriminals breached the Police National Legal Database (PNLD) on July 26, 2026 and posted over 100,000 officers’ names and emails on the dark web.
Norfolk and Suffolk Constabularies confirmed officers in their forces were among those exposed, and a PNLD spokesperson said no passwords were compromised.
Cyber-security firms, the National Crime Agency and the Information Commissioner’s Office are aiding probe, and police sources say the hacking group ExfilSquad targeted 114,000 PNLD subscribers.

1 / 4