UK Watchdog Report: Breaches at IT Suppliers Put Police Data at Risk

A report released October 27 by HMICFRS, the UK’s police and fire inspectorate, points to repeated breaches at suppliers that hold police information. What’s new are the findings of its cyber readiness inspection of police forces and fire and rescue services. The attacks it describes happened earlier, between 2021 and 2025.

What the inspectors found

According to the report, the Police Digital Service and the National Police Chiefs’ Council reported the attacks. In each case, attackers got into environments run by third-party IT service providers that held police data.

The public version of the report doesn’t name every affected organization. It also doesn’t give the number of breaches or say whether any data was stolen. That means it doesn’t support claims of a new data leak with a known size. It does show a problem with oversight of information stored outside an organization’s own infrastructure.

The inspection covered three police forces and three fire and rescue services. Inspectors found that processes for checking supplier security were not strong enough. Checks often relied on the suppliers’ own assurances, and contracts didn’t always provide for ongoing oversight. There were also problems with access to event logs and with timely incident notification.

What organizations should check

The findings also matter for companies that trust suppliers with customer data, employee data or operational records. The steps below are our editorial recommendations, based on the gaps the report describes:

• Map what information each supplier and its subcontractors hold.
• Check that contracts require suppliers to report incidents and to give access to the evidence needed for an investigation.
• Verify security controls throughout the relationship, and again after any significant change to the service.
• Decide who has the authority to cut off a supplier’s access when there is a threat.
• Rehearse how the business will operate if an external service goes down.

The report covers UK public services. Its recommendations create no legal obligations for Polish companies, but the same gaps can exist in other sectors as well.

SecurHUB’s take

A supplier assessment should look at whether the supplier can detect and investigate an incident, not just at the security controls described on paper. Security audits can help you organize your requirements for partners and confirm that partners actually meet them.

Sources: TSN, CyberWarriors Middle East, Milton Keynes Citizen