Suppliers that hold police information in England and Wales have been hit by cyberattacks again and again since 2021, according to a report published on Tuesday 27 October 2026 by His Majesty's Inspectorate of Constabulary and Fire & Rescue Services. The report does not name the firms, the forces involved or say whether any data was stolen.
The inspectorate said the Police Digital Service and the National Police Chiefs' Council shared "information on multiple cyberattacks" affecting "third-party ICT supply chains which held police information". It says it deliberately removed operational details it judged unsuitable for publication, so the number of attacks is not given either.
252 incidents in three months
The Police Digital Service, set up by the government in 2021, runs a national security operations centre that watches for cyber threats across policing. It recorded 252 cyber security incidents affecting policing in the first three months of 2026, along with 796 near misses, meaning incidents where no data or systems were harmed.
The incidents included malware, attempts at unauthorised access and accidental disclosures by police staff. The report does not say how many of the 252 led to data being lost. Inspectors also found examples of police forces and fire and rescue services suffering attacks that hit operational systems, compromised data and disrupted services. Leaders in both sectors told them that further attacks were highly likely.
The blind spot is the supplier
The most striking warning concerns information that sits on suppliers' systems rather than inside police networks. The Police Digital Service told inspectors that this data is among the biggest risks the sector faces, because it is outside the service's own monitoring. The risk is greatest where suppliers handle information about victims, safeguarding, intelligence and investigations.
Inspectors found that most police supplier contracts included no ongoing cyber security checks. In some cases staff could not say whether a supplier was obliged to report an incident promptly. In several organisations, the system logs kept by suppliers were not routinely visible to the in-house security teams responsible for spotting an intrusion.
Neither the Home Office nor the National Police Chiefs' Council answered questions from The Record, the cyber security news site run by Recorded Future, about whether police data was taken in the supplier attacks.
Left out of the new cyber law
The report also criticises the government for leaving policing and fire services out of three key documents: the National Risk Register 2025, the Government Cyber Action Plan published in January 2026, and the Cyber Security and Resilience (Network and Information Systems) Bill, which is still going through Parliament. That bill is meant to tighten security at organisations that run essential services such as healthcare, water and energy.
According to the inspectorate, no government official it asked could explain why the two sectors were excluded from the action plan or the bill. It called the omission concerning, given how central police and fire services are to public safety.
Breaches the public already knows about
Some supply-chain incidents from the period are already public. In 2023, a ransomware attack on the ID card maker Digital ID exposed details of Metropolitan Police officers and staff and led to the theft of thousands of Greater Manchester Police officers' names and photographs. In July 2026, the Police National Legal Database, run by West Yorkshire Police and used by every force in England and Wales, confirmed that hackers had stolen officers' and staff contact details; it said it held no confidential information about victims, witnesses or offenders. In September, Dyfed-Powys Police said a cyberattack had disrupted some non-emergency systems and may have exposed staff information.
"The cyber threat to police forces and fire and rescue services is significant and expanding rapidly," said Michelle Skeer, His Majesty's Inspector of Constabulary. "A major cyberattack is not a hypothetical scenario."
The police hold some of the most sensitive records the state keeps on its citizens, from victims' statements to intelligence files. The report shows that a growing share of those records sits with private contractors whom forces often cannot see into, while the one cyber law now before Parliament leaves policing out entirely.
Photo: a Metropolitan Police officer beside a patrol car in Hounslow, west London. JohnGold6000 / Wikimedia Commons (CC BY 4.0).
227.18 SRY