UK Police Data Exposed to Repeated Supplier Breaches, Watchdog Reports

What happened

His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services reported that third‑party ICT suppliers handling police data have been breached repeatedly since 2021. The Police Digital Service and the National Police Chiefs’ Council supplied incident data showing 252 cybersecurity events and 796 near‑misses in Q1, involving malware, unauthorized access attempts and accidental disclosures. Contracts with many suppliers lack ongoing security assurance, incident‑reporting obligations, and log‑visibility for police teams.

Why it matters for trust and compliance

• The report underscores the need for robust third‑party risk management and continuous assurance monitoring to satisfy control‑assurance objectives across frameworks.
• Implement continuous monitoring of supplier security controls to generate defensible audit evidence.
• Update contracts to embed mandatory incident‑reporting and log‑access clauses.

Who is affected

Recommended actions

1. Add security‑assurance clauses to all supplier contracts, specifying regular assessments and incident‑reporting.
2. Deploy a continuous monitoring solution that ingests supplier logs and security metrics for real‑time assurance.