A breach has exposed the names, employing organisations and work email addresses of more than 100,000 UK police and criminal justice staff. It appears to have required no malware and no zero-day. A misconfigured permission on a public-facing web portal is the reported cause.
The incident involves the Police National Legal Database, a West Yorkshire Police-operated legal information resource serving all 43 Home Office forces in England and Wales. PNLD also hosts the public-facing Ask the Police site.
"Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web," a PNLD notice states. "There is no evidence to suggest that passwords or other security credentials have been compromised.
The operator says it is working with specialist cyber security organisations and the UK National Crime Agency. All affected organisations were contacted in the days following the incident, and the Information Commissioner's Office has been notified.
PNLD stresses the scope limit. It "is not a crime recording system and does not hold confidential information relating to victims, witnesses, or offenders". Separately, names and email addresses of people who had previously submitted a question to Ask the Police were published.
The configuration claim
The technical explanation reported by CPO Magazine came from Denis Calderone, chief technology officer at Suzu Labs.
"A simple misconfiguration in a Microsoft Power Pages portal was the impetus for this breach," Mr Calderone said. "PNLD's Anonymous Users web role had read access to backend Dataverse tables, which means the subscriber database was queryable through a standard API call by anyone who visited the site without logging in."
He drew a direct comparison with an earlier era of exposure. "And similar to the open S3 bucket issue that was so prevalent a few years ago, ExfilSquad didn't need to deploy malware or exploit a zero-day, they just had to hunt for misconfigured endpoints."
PNLD has not attributed the incident to any threat actor and has not disclosed the attack vector. It has not independently confirmed the number of victims.
Directory data as targeting material
Extortion group ExfilSquad has claimed responsibility, saying it took 1.9GB containing 135,000 records. It breaks that down as 114,000 law enforcement and justice professional records and 21,000 personal details from Ask the Police submissions. The group has demanded an unspecified ransom.
The data would not normally rate as sensitive. Names, work emails and employers are the contents of most corporate directories. Seemant Sehgal, founder and chief executive of BreachLock, argued the aggregation changes the calculation.
"A database of 135,000 verified identities across law enforcement and criminal justice, with employing organizations attached, is not contact information in the ordinary sense," Mr Sehgal said. "That combination tells an adversary exactly who works where, in what capacity, and how to reach them directly. The downstream risk to be concerned about here is social engineering, targeted harassment, and covert approaches to personnel who would otherwise be a lot more difficult to identify and map."
The low-code exposure surface
Low-code portal platforms bind a web-facing site directly to a backing data store, and permissions are assigned through role configuration rather than written code. An anonymous role granted table-level read access does not look like a vulnerability in any scanner. It looks like a setting.
That places the control point with whoever configures the portal, which is often a business team rather than a security function. It also means the exposure is invisible to code review and to most penetration testing scopes that begin after authentication.
ExfilSquad has been linked to a UK Department for Education breach involving more than 600,000 helpdesk and Turing Scheme records. Claimed incidents also include Analog Devices, Newcastle University, Wesco International and the cities of Houston and Atlanta. The group also claims to have breached Microsoft and taken 13GB of internal support tickets, password hashes and access permissions. No evidence links that claim to the PNLD incident.