The Police National Legal Database, the legal reference system used by all 43 Home Office police forces in England and Wales, has confirmed a data breach affecting contact details for police officers, staff and criminal justice professionals. It is a reminder that data breaches are not confined to retailers and banks, and that verified, evidenced leads matter just as much when the affected individuals are less obvious.

What happened

PNLD identified the intrusion on 26 July 2026 and has since confirmed that names, organisations and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners and members of the public who used its Ask the Police service were compromised. The exposed data, roughly 135,000 records in total, has been published on the dark web. The breach has been attributed to a group known as ExfilSquad. PNLD has notified the Information Commissioner's Office and is working with the National Crime Agency and specialist cybersecurity firms, and says there is no evidence passwords or other credentials were compromised.

What compensation could look like

UK GDPR gives individuals the right to claim compensation for distress caused by a data breach, even without direct financial loss. Courts have awarded amounts from a few hundred pounds up to several thousand for distress alone, with higher awards where more sensitive categories of data are involved. For a breach affecting police and justice staff specifically, the professional and personal safety implications of exposed work contact details add a further layer to any claim.

Why this keeps happening

PNLD is the latest in a run of significant UK data breaches this year, following incidents affecting Lloyds, Halifax and Bank of Scotland customers in March, Booking.com guests in April, and the University of Nottingham's Campus Solutions platform in June. Each one produces a fresh wave of people entitled to claim and, in most cases, unsure of how to do it.

How we verify data breach leads

A data breach claim is only as strong as the evidence behind it. We only generate leads through our own digital campaigns, so every enquiry comes with a documented, evidenced consent trail linking the individual to the specific incident they are claiming about, engineered around compliance from day one rather than something we add once a breach makes headlines.