[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzGcTVheVmS7yXL4AXDIDo-LGdENJ1lai9Clbe9ESM4w":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0b966767-f924-41a6-b701-693de161f3ba","ExfilSquad hackers leak info of over 100,000 UK police officers, staff","exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff-a15b4f","A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. [...]","The Police National Legal Database (PNLD), used by 43 UK Home Office police forces and British Transport Police, suffered a cyberattack exposing contact details of over 100,000 police officers and criminal justice professionals. The ExfilSquad data extortion group claimed responsibility, alleging theft of 1.9 GB including 135,000 records (114,000 PNLD subscribers and 21,000 Ask the Police users), and demanded ransom. The breach, detected July 26, 2026, exposed full names, organizations, and email addresses, but no passwords or sensitive victim\u002Fwitness data were compromised.","ExfilSquad leaks contact data of 100,000+ UK police officers from Police National Legal Database breach.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fexfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F09\u002F14\u002Fuk-police.jpg","2026-08-03T15:04:39+00:00","2026-08-03T16:00:29.845198+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"ExfilSquad","threat_actor",{"name":21,"type":22},"Police National Legal Database (PNLD)","product",{"name":24,"type":22},"Ask the Police",{"name":26,"type":27},"UK Home Office","vendor",{"name":29,"type":27},"National Crime Agency (NCA)",{"name":31,"type":27},"Information Commissioner's Office (ICO)","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":18,"context":56},"malware","Data extortion\u002Fexfiltration group operating ransomware-as-extortion model",[26,29,31],{"controls":59,"vendors":143},[60,89,114],{"slug":61,"name":62,"problem":63,"products":64},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":52,"name":90,"problem":91,"products":92},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":110,"product_name":111,"url":112,"description":113},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":115,"name":116,"problem":117,"products":118},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":165},"exfilsquad-leaks-100000-uk-police-records-in-pnld-breach","ExfilSquad Leaks 100,000+ UK Police Records in PNLD Breach","The Police National Legal Database breach exposed personally identifiable information of over 100,000 law enforcement and criminal justice professionals, highlighting the severe risk of centralised databases holding sensitive personnel data without adequate protective controls. The fact that a single extortion group could exfiltrate 1.9 GB of subscriber records suggests insufficient data access controls, inadequate monitoring of bulk data movement, and potentially weak segmentation around a high-value target. While no passwords or victim\u002Fwitness data were reportedly compromised, the exposure of officer names, organisations, and email addresses creates significant risks for targeted phishing, social engineering, and physical safety threats against named officers. Organisations holding sensitive professional directories must treat personnel contact databases with the same rigour as classified operational data.",[149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 3 – Data Protection","CIS Control 5 – Account Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defence","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 AU-2 – Audit Events","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 IR-4 – Incident Handling","GDPR Article 5(1)(c) – Data Minimisation","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","UK Data Protection Act 2018 – Section 57 (Law Enforcement Processing)","ISO\u002FIEC 27001:2022 – A.8.11 Data Masking","ISO\u002FIEC 27001:2022 – A.8.15 Logging","ITIL 4 – Incident Management Practice",{}]