The PNLD data breach has put a spotlight on how sensitive contact information can be exposed when access controls fail. The Police National Legal Database (PNLD) confirmed that contact details for police, government partners, and customers were compromised and later published on the dark web.
According to PNLD, the exposed data included names, the organisations those people work for, and work email addresses. Importantly, PNLD stated there is no evidence that passwords or other security credentials were compromised.
What information was exposed in the PNLD data breach?
PNLD reported that the intruder published contact information covering multiple groups connected to policing and criminal justice. That included police officers and police staff, criminal justice professionals, government partners, and customers.
In addition, the incident also included some names and email addresses belonging to individuals who had submitted questions through Ask the Police. UK government guidance highlighted a practical risk: when an attacker can associate names with real work emails, phishing messages aimed at named officers may look more credible.
What PNLD clarified about credentials and system scope
PNLD tried to limit assumptions about the impact. It said it has no evidence that passwords or other security credentials were taken. The organisation also described the PNLD service clearly and differentiated it from other police systems.
PNLD is described as a platform that provides legal information, products, and services to UK police forces and criminal justice organisations. It is not the Police National Computer or the Police National Database. It is also not a crime-recording system and does not hold confidential information about victims, witnesses, or offenders.
Who was notified, and what’s known so far
PNLD said it contacted all affected organisations and provided additional information and guidance. Users of Ask the Police were already sent an email with further guidance. PNLD also reported the matter to the Information Commissioner’s Office (ICO) and said it is working with the National Crime Agency (NCA) and specialist cybersecurity organisations.
As of August 3, 2026, PNLD had not publicly disclosed key breach details such as how many people were affected, when the intrusion began, how long access lasted, or the full volume of information that was taken.
PNLD’s published breach notice described the fields that were exposed, but did not provide a victim total. Separately, PNLD’s 2025–26 annual summary cited 108,429 police registrations and support for all 43 Home Office police forces. However, PNLD presented that figure as a user-base metric, not a count of breach victims.
Why the technology stack drew attention
PNLD previously said, in its 2023–24 annual summary, that the database uses Microsoft Power Platform technology. The Hacker News later corroborated that the breach notice page referenced assets hosted on Microsoft’s content.powerapps.com domain.
This supports that the service is connected to the Power Platform ecosystem, but it does not automatically show how an attacker obtained the data. In other words, the platform connection aligns with the underlying stack without proving the precise intrusion path.
VenariX’s review: a potential public portal scenario
VenariX reviewed samples linked to some of the claimed victims associated with a leak listing. In its assessment, it found data structures that were consistent with Microsoft Dataverse formatting across the samples it examined. VenariX also described a case where a public portal returned records without authentication, and the returned records matched the group’s published data.
From there, VenariX evaluated a likely campaign-level route as a public Power Pages site that could allow Anonymous Users access to Dataverse tables. The analysis suggested the path would rely on an enabled Power Pages Web API or a legacy OData feed.
How anonymous access can expose table data
Microsoft documentation, as referenced by the analysis, indicates that granting the Anonymous Users role access to a table can make that table’s data visible to anyone who visits the site. Microsoft’s Web API documentation also notes that the /_api interface reflects the permissions attached to each web role.
VenariX’s point was not that this is guaranteed to be what happened at PNLD, but that it fits a pattern that operators could test and verify. It also noted that evidence did not confirm that every organisation was impacted through a Power Apps portal or through the same configuration issue.
Is Power Pages the confirmed root cause?
At this stage, the Power Pages access route remains a hypothesis rather than a confirmed explanation of how the PNLD incident began. As of August 3, 2026, neither PNLD’s notice nor VenariX’s report identified a PNLD-specific endpoint, a permission setting, an API route, or supporting logs that would conclusively establish the root cause.
VenariX also emphasised that the findings so far do not prove a single, universal misconfiguration impacted all affected organisations. More investigation would be required to move from a plausible access pattern to a verified breach timeline and mechanism.
Recommended checks to reduce the risk of public data exposure
Even if Power Pages is not the confirmed trigger, the reviewed pattern offers practical lessons. Microsoft provides tenant-level governance controls that can block unauthenticated users from reading Dataverse data while still allowing public form submissions.
VenariX recommended that Power Pages operators take a targeted approach, including:
- Reviewing Anonymous Users table permissions
- Checking Web API settings
- Verifying legacy OData feeds
- Validating access from an unauthenticated browser session
These steps are meant to address the configuration pattern identified by VenariX—while not claiming that the exact PNLD path is already proven.
What the leak site claimed, and what was not found
The leak listing included PNLD on July 26 under the ExfilSquad moniker. However, PNLD did not attribute the incident to a specific group. VenariX reported that it found no evidence of ransomware deployment, malware use, lateral movement, or exploitation of a software vulnerability in the campaign material it reviewed.
Crucially, PNLD has not publicly disclosed the exact route the attacker used, the number of unique people affected, or the full data volume published.
Why this matters beyond PNLD
The PNLD data breach illustrates a recurring security challenge: when systems publish or expose contact details to external parties—whether by design, via customer portals, or through misconfigured public endpoints—attackers can transform that information into operational advantage.
In this case, the connection between exposed names and real work emails could improve the effectiveness of phishing campaigns. That threat is especially relevant for organisations where trust and verification processes rely heavily on context such as roles, names, and legitimate-looking email addresses.
Until the intrusion path is fully documented, the best immediate takeaway is that organisations using public-facing features on platforms like Power Pages and Dataverse should regularly audit anonymous access paths, API permissions, and unauthenticated responses.
Conclusion
The PNLD data breach confirmed that police and government contact information was compromised and posted on the dark web. PNLD stated there is no evidence that passwords or other credentials were taken, but key details such as the full number of people affected and the complete intrusion timeline remain undisclosed.
Investigative analysis points to a potential public portal and anonymous access pattern involving Power Pages and Dataverse permissions. Still, investigators have not yet confirmed the exact root cause, making thorough access testing and permission reviews essential for preventing similar exposure.
Source: https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html
