Dyfed-Powys Police cyber-attack may have exposed staff data

Dyfed-Powys Police was hacked on 14 September, disrupting non-emergency systems. Staff information may have been accessed, though public data appears unaffected.

Welsh force investigates staff data breach after September hack

Dyfed-Powys Police may have had staff information stolen in a cyber-attack identified on 14 September, The Guardian UK reports. The force, which covers a large swathe of rural Wales and employs more than 2,000 officers and civilian staff, said the incident disrupted "some non-emergency systems" but that public data did not appear to have been affected.

"At this stage, our investigation has found no evidence that members of the public's personal data has been accessed or compromised as a result of this incident," a force spokesperson said.

Investigators are, however, still examining whether hackers obtained information belonging to staff. "We are continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information," the spokesperson added, noting that colleagues would be given appropriate guidance if needed.

Online and email contact channels for the force went offline following the attack before later being restored. Cybersecurity specialists are supporting the response, and force systems have been subjected to what the force described as "precautionary measures" while the investigation continues.

The force serves Carmarthenshire, Ceredigion, Pembrokeshire and Powys — a combined population of more than 500,000, a figure that rises considerably during the tourist season. The investigation is being led by Tarian, the regional organised crime unit for southern Wales.

The Information Commissioner's Office, the UK's data regulator, has been notified. "We can confirm we have received a breach report from Dyfed-Powys police and we are assessing the information provided," an ICO spokesperson said.

The incident follows a separate breach disclosed in July, in which hackers penetrated the police national legal database (PNLD), a resource used by forces across the UK. The attackers claimed to have extracted 135,000 records. The PNLD confirmed the compromised details included names, employing organisations and work email addresses of police officers and criminal justice staff, but said the database holds no confidential victim, witness or offender information.

Dyfed-Powys Police said it would issue further updates "when we are in a position to do so".

Source: The Guardian UK