The UK’s police legal database has been hacked, leaving work contact details for criminal justice staff on the dark web.
According to The Guardian, the Police National Legal Database admitted it had suffered a cyber attack over the weekend, which is a serious look for a national police resource.
PNLD said attackers took names, organisations and work email addresses belonging to police officers, police staff, government partners and customers.
The outfit insisted there was “no evidence to suggest that passwords or other security credentials have been compromised.”
That is the sort of sentence meant to calm everyone down, although it still leaves a handy contact list sitting where criminals can admire it.
PNLD did not say how the attackers got in. It did say the stolen information had already been published on the dark web.
The breach affected people working in criminal justice, which makes it more awkward than the usual corporate leak of sales contacts and newsletter victims. PNLD brought in cybersecurity specialists after the break-in. It notified the National Crime Agency, which has started poking through the wreckage.
“All affected organisations were contacted in the days following the incident and provided with further information and guidance. The Information Commissioner’s Office (ICO) has also been notified.”
A gang calling itself ExfilSquad claimed responsibility for the attack. The group claimed it had stolen 135,000 contact records and posted samples to support its boast. ExfilSquad said it had demanded a ransom in exchange for not dumping the data.
In its dark web post, the gang claimed it had taken 1.9GB of data. It said that included information on 114,000 PNLD subscribers and 21,000 Ask the Police users. Ask the Police is the public-facing site where people can look up answers to common policing and legal questions.
Some names and email addresses from people who submitted questions to that service were reportedly caught in the mess. PNLD said the database did not hold confidential victim, witness or offender information, which is useful but not exactly a triumph.
ExfilSquad is a relatively new name in the cybercrime zoo and has not built the same brand recognition as the ransomware dinosaurs. Before PNLD, the crew claimed an attack on US semiconductor outfit Analog Devices.
Police databases are supposed to be boring, locked down and dull enough to make criminals go elsewhere. Instead, PNLD has handed attackers a tidy list of people who work around law enforcement, which is exactly the sort of thing phishers turn into tomorrow’s “urgent security update” email.
