Summary
- Inspectors identified multiple attacks involving suppliers holding British police information.
- The Police Digital Service logged 252 incidents and 796 near misses in January–March 2026.
- Police and fire organisations face shortcomings in contract assurance, legacy systems and cyber preparedness.
A new inspection of police and fire-service cybersecurity has identified repeated compromises of suppliers holding British police information, alongside weaknesses in security assurance, legacy IT and incident readiness. His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services published the findings on 27 October.
The report describes multiple cyberattacks between 2021 and 2025 in which information handled for policing was at risk because third-party technology suppliers, rather than police systems directly, were compromised. It does not identify the suppliers or specify how much information, if any, was taken. Those limits are central to interpreting the findings responsibly.
The Police Digital Service also recorded 252 cybersecurity incidents and 796 near misses affecting policing between January and March 2026. The near-miss category refers to events without a harmful breach of data or IT systems. The 252 incidents span different causes, including malware, attempts at unauthorised access and accidental disclosures; they are not 252 confirmed successful hacks.
Assurance ends too early
Inspectors found that most of the supplier contracts they examined did not include continuous cybersecurity assurance. All six organisations visited relied on external suppliers, but none had comprehensive processes sufficient to assure the security of those relationships. Assurance often relied heavily on suppliers’ own declarations, rather than continuing independent evidence after a contract was awarded.
In some organisations, staff could not establish whether their supplier had a duty to notify a cyber incident promptly. Where data or systems were hosted externally, logs were sometimes limited or unavailable to the force or fire service. Both shortcomings complicate an investigation because security teams may learn about a compromise late and then lack the records needed to establish what happened.
Police datasets may include safeguarding material, information about victims and witnesses, operational intelligence and details of investigations. Supplier systems holding such information do not become less sensitive simply because they sit outside the police network. Contractual boundaries and technical boundaries are different things, and responsibility for sensitive records remains a question even after processing is outsourced.
The inspectorate recommends improved procurement and contract management, clearer baseline standards and stronger external validation. Chief constables are expected to review relevant IT contracts and procurement arrangements by May 2027, with the Police Digital Service’s third-party assurance standards among the tools recommended.
National arrangements remain uneven
The report also identifies reliance on legacy systems, inconsistent basic controls and weaknesses in the preparation of senior personnel. Some inspected organisations lacked sufficiently developed identity and access processes, while outdated technology restricted their ability to apply contemporary protective measures.
Another criticism concerns national policy coverage. The inspectorate noted that policing and fire services were absent from the Government Cyber Action Plan’s scope and were not specifically regulated through the Cyber Security and Resilience Bill as it stood during the inspection. Supplier businesses may fall within future provisions, but that does not automatically establish equivalent sector-specific oversight of emergency services.
The Police Digital Service operates a National Management Centre intended to coordinate cybersecurity monitoring across policing. There is no directly equivalent national capability for English fire and rescue services, a gap inspectors associate with differences in preparedness and visibility. The report calls for clearer leadership responsibilities and measurable improvements rather than treating central monitoring as a substitute for each organisation’s controls.
Emergency-service cyber failures can affect operations even without publication of personal data. Staff may be unable to use systems required for dispatch, administration or casework, while restoring services can absorb resources otherwise allocated to public-facing work. The inspection records examples of disruption, although it deliberately omits some operationally sensitive detail.
The inspectorate’s recommendations call for stronger contractual assurance and procurement controls, with chief constables expected to review relevant IT contracts by May 2027. The report also identifies gaps in fire-service national monitoring and in access to supplier incident evidence.
