Cyber-attack on Dyfed-Powys police ‘may have accessed staff information’

A police force in Wales has said staff information may have been “accessed or compromised” in a cyber-attack.

Dyfed-Powys police, which has more than 2,000 officers and civilian staff, said it was hacked on 14 September in an incident that disrupted “some non-emergency systems”.

The force said there was no evidence that personal data belonging to members of the public had been affected. The force covers the counties of Carmarthenshire, Ceredigion, Pembrokeshire, and Powys in Wales.

“At this stage, our investigation has found no evidence that members of the public’s personal data has been accessed or compromised as a result of this incident,” said a spokesperson.

However, the force said it was continuing to investigate the possibility that staff information may have been accessed or compromised, with the implication that it could have been taken by hackers.

“We are … continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required,” said a spokesperson.

The force said it was receiving support from cybersecurity specialists and its systems had been subjected to “precautionary measures” while an investigation was under way.

Online and email contacts for the force were unavailable after the attack, which was identified on the day it happened, but have since been restored.

The Information Commissioner’s Office, the UK’s data watchdog, has been notified of the incident.

A spokesperson for the force added: “We understand the potential concern this may cause and want to reassure the public that we have and will continue to take all necessary steps to protect our information and maintain the security of our systems.

“We will provide further updates when we are in a position to do so.”

The area served by Dyfed-Powys police equates to more than 500,000 people, a number that rises significantly with tourists each year.

The investigation is being managed by Tarian, the regional organised crime unit (ROCU) for southern Wales, and force systems are being monitored.

A spokesperson for the ICO said: “We can confirm we have received a breach report from Dyfed-Powys police and we are assessing the information provided.”

In July it was revealed that hackers had breached the police national legal database (PNLD), which provides legal assistance to UK police forces. The cybercriminals claimed to have taken 135,000 pieces of data.

The PNLD said the details taken related to “police officers and those working in criminal justice including their name, the force or organisation they work for and their work email address”. However, the database does not contain confidential victim, witness or offender information.