← Police National Legal Database (PNLD)

2026 Police National Legal Database — ExfilSquad leak; ~135K law-enforcement contacts (NCA/NCSC)

2026 135.0K records affected Share on X

Data compromised

Full names, work emails, police force / organisation area for officers and criminal-justice staff; Times reported 100,000+ staff including officials linked to MoD, Home Office, NCA and CPS via the shared legal database. Actor/press summaries cite ~135,000 contact records. Ask the Police public users’ names/addresses also reported in some coverage. PNLD stated it does not hold confidential victim/witness/offender investigation data.

Technical writeup

Verified incident acknowledgment — NCA told The Times limited personal details of some NCA officers may have been published as a result of the PNLD incident; NCSC said it is supporting law enforcement on an incident affecting PNLD; FutureScot reported PNLD (hosted by West Yorkshire Police) referred itself to the ICO. ExfilSquad listed ~135k law-enforcement contact records (names, emails, force area) on leak monitors from ~26 July 2026; The Times (2 Aug) reported full names and contact details for more than 100,000 police officers and staff on the dark web, with compromised data spanning MoD, Home Office, NCA and CPS users of the shared legal database. This follows the related UK DfE ExfilSquad help-desk/Turing Scheme incident (~607k lines). PNLD provides legal assistance to Home Office forces in England and Wales; Police Federation raised officer-safety concerns. Immediate risk was described as low by PNLD regarding investigation content, but contact data enables targeted phishing. recordsAffected uses the ~135,000 press/actor figure widely cited alongside Times’ 100,000+ staff framing.

Root cause

ExfilSquad data-theft extortion against Police National Legal Database (hosted by West Yorkshire Police); dark-web leak of contact records (Times/Telegraph/The Record; NCA acknowledgment)

References

Breaches you may like