Contained Medium impact Data breach Checked 2d ago

ExfilSquad hack exposes UK Police National Legal Database

A hacking group calling itself ExfilSquad broke into the UK's Police National Legal Database (PNLD) and its Ask the Police service, then posted the stolen data on the dark web. PNLD confirmed the breach, said it happened over a weekend, and reported it to the National Crime Agency and the Information Commissioner's Office. A later report said the breach needed no malware or zero-day exploit, just a misconfigured permission on a public-facing web portal. The group also claims to have stolen data from other targets, including the UK Department for Education, as part of the same extortion spree.

Started
Jul 26, 2026
Latest activity
Aug 17, 2026
Attributed to
ExfilSquadConfirmed
Where
United Kingdom
Sectors
Government
Scale
Police National Legal Database plus its Ask the Police service, about 135,000 records

Current status

Searches on 2026-09-09 found no credible reporting or official statement dated after 2026-08-17.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

ExfilSquad itself claimed the attack and posted the stolen files on the dark web; PNLD confirmed a breach occurred but did not name the attacker in its statement.

Impact

Names, organizations, and work email addresses of roughly 114,000 PNLD subscribers and 21,000 Ask the Police users were stolen and published online. PNLD said passwords and other login credentials were not affected.

What to do

Affected police staff and criminal justice professionals should watch for phishing emails that reference their real name, agency, or role.

Timeline

  1. Aug 17, 2026

    A follow-up report said the breach required no malware or zero-day exploit. The reported cause was a misconfigured permission on a public-facing web portal. PNLD reiterated it is working with cyber security specialists and the National Crime Agency, and that the Information Commissioner's Office has been notified.

    Containedidm.net.au
  2. Aug 4, 2026

    PNLD publicly confirmed the breach, said it happened over a weekend, and reported it to the National Crime Agency and the Information Commissioner's Office.

    Containedinfosecurity-magazine.com
  3. Jul 26, 2026

    ExfilSquad claimed on a dark web leak site to have stolen data from the Police National Legal Database.

    Emergingransomware.live

Sources

Related reports