Worrying news comes from the United Kingdom: a group of cybercriminals has managed to break into a database used by the police and has published the contact data of more than 100,000 officers and workers. We explain what happened, who is behind it and why this matters to you even if you do not live there.
What happened
The group, which calls itself ExfilSquad, claims to have stolen about 135,000 records from the National Police in the UK’s legal database, known as PNLD. It is an online service that has been used for more than 30 years by the 43 police forces of England and Wales, as well as by the British transport police.
The intrusion was detected on July 26. Since then, the company that manages the service has been working with the National Crime Agency and computer security experts to investigate what happened. The criminals have published a small sample of the stolen data on the internet and are demanding a ransom in exchange for not revealing the rest.
What data has been leaked
According to PNLD itself, the leak includes full names, the organization they work for and the email addresses of police officers, force staff, legal professionals and government partners.
Also affected are people who used the public website "Ask the Police", a site where anyone can ask questions about legal and security topics. If you sent a question through that page, your name and email address could be among the stolen data.
There is one reassuring detail: the database does not contain confidential information about victims, witnesses or criminals, and there is no evidence that passwords were stolen. That is, what came to light is contact data, not investigation secrets.
Why it is so worrying
Although an email address and a name may seem unimportant, for an officer investigating serious crimes, having their personal data in the hands of criminals is a real risk. One of those affected, who works against organized crime, told The Times newspaper that the leak was "deeply unsettling" for him.
Moreover, this is not an isolated story. It is the third leak in a week affecting UK public bodies. Days earlier, another attack also claimed by ExfilSquad exposed more than 600,000 records from the Department for Education, and a state investment body also suffered a data breach.
What ExfilSquad is
ExfilSquad is a group dedicated to data theft and extortion. Its way of operating is simple: it enters an organization’s systems, copies all the information it can and then threatens to publish it if it does not receive money. Before this attack, it had already claimed others, such as the one suffered by the American semiconductor manufacturer Analog Devices.
Experts believe its motivation is economic, not political. That is, it wants money, and it is not behind a foreign government. But its success shows something important: even the best-resourced organizations, like the police, can be vulnerable if their systems are not up to date.
What you can learn from this
This story reminds us of three things that also protect you:
- Use a different password for each service. That way, if a website where you registered suffers a leak, criminals cannot use that same password to get into your email or your bank account. It is like having a different key for each door of your house.
- Distrust emails that arrive after a leak. With your data in their hands, scammers can send you fake messages pretending to be companies to trick you. If something seems off, do not click on the links.
- Review what information you share on the internet. Every piece of data you post (your name, your phone number, where you work) is a piece that someone could join with others.
The investigation into this leak continues and the British authorities have already alerted all affected bodies. Meanwhile, the story serves as a reminder that safety online is everyone’s business, including the institutions that should protect us.
