Dyfed-Powys Police, the force covering mid and west Wales, confirmed on September 25, 2026 that it suffered a cyberattack that may have exposed information belonging to its own staff. According to the BBC, the force said its investigation had so far found no evidence that the public’s personal data had been accessed or compromised, but that it was still working to determine whether employee records were touched. The disclosure lands amid a run of public-sector breaches across the UK in 2026, and it puts a regional police force squarely in the same conversation as government departments and local councils that have spent the year fending off intrusions. It also follows a pattern of guarded disclosure from the force: responding to a Freedom of Information request filed in July 2025, Dyfed-Powys Police declined to confirm or deny whether it held any information on other cyber breaches, a stance that foreshadowed the careful, conditional language it would use roughly 14 months later when the September 2026 attack came to light.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Timeline: How the Dyfed-Powys Police Cyberattack Unfolded
Dyfed-Powys Police identified the attack on September 14, 2026, according to the BBC’s reporting, a detection date that The Cyber Express later corroborated, reporting that the force’s investigation began immediately once the intrusion was identified that day. That is 11 days before the force went public with the incident, a gap that mirrors how other UK policing and government bodies have handled disclosure this year: quietly investigate first, confirm only once the scope becomes clearer or a leak forces the issue into the open. During those 11 days, the force said some non-emergency systems were disrupted, and, as The Register separately reported, online and email contact channels for the public were unavailable for a period before being restored.
The force has not published a granular timeline of what happened hour by hour, and it has not said how the intrusion was first detected, whether through internal monitoring, an external tip, or a ransomware note. What is confirmed is the start date, the type of systems hit, and the fact that the force chose to notify the Information Commissioner’s Office (ICO) as part of its response, a step that UK data-protection law requires when personal data may be at risk.
What Data May Have Been Compromised
The force drew a clear line between two categories of information: data belonging to members of the public, and data belonging to its own staff. On the first, Dyfed-Powys Police said its investigation had found no evidence of access or compromise. On the second, the picture is murkier. The force said it was continuing to investigate whether information relating to staff may have been accessed, and that it was taking steps to protect that information while the review continues. Security Magazine’s coverage of the incident described that second category in the same unresolved terms, noting that the potential staff-data exposure remained an open question under active investigation rather than a confirmed compromise.
No specific data fields have been named publicly, so it is not yet confirmed whether the exposure, if it materializes, would touch names, contact details, payroll information, or something narrower like internal directories. That ambiguity is itself notable: a police force’s staff records carry more risk than a typical corporate HR database, since officer identities, deployment details, and informant-handling information can carry safety implications if they end up in the wrong hands. The 2023 Greater Manchester Police case, covered below, is the clearest precedent for why staff-data exposure at a UK police force is treated as a distinct and serious category, separate from a routine consumer breach like the one that hit Gyazo’s 23.6 million users earlier this year.
Why 999 and 101 Stayed Online
One detail stands out in the force’s account: emergency contact routes, the 999 line for immediate emergencies and 101 for non-emergency reporting, continued to operate throughout the incident, a point corroborated separately by both ITV News and OODAloop, each of which reported that the two phone services remained unaffected and fully operational. Only “non-emergency systems,” in the force’s own phrasing, were disrupted. That distinction suggests some degree of network segmentation between operationally critical call-handling infrastructure and administrative or public-facing systems such as web forms and email.
Segmentation of this kind is a basic tenet of resilience planning for any organization that cannot afford downtime on its most safety-critical function, and it appears to have worked as intended here. Whether that separation was the product of deliberate design or simply an accident of which systems the attacker happened to reach first is not something the available reporting answers. Either way, the fact that residents of Dyfed-Powys’ patch, which spans Carmarthenshire, Ceredigion, Pembrokeshire, and Powys, could still reach police in an emergency throughout the disruption limited the immediate public-safety fallout even as the data question remains open.
Dyfed-Powys Police’s Official Response
The force’s public statements, carried by the BBC and by The Register, stuck to careful, conditional language rather than firm conclusions. A Dyfed-Powys Police spokesperson said: “At this stage, our investigation has found no evidence that members of the public’s personal data has been accessed or compromised as a result of this incident,” according to the BBC.
On the open question of staff data, the same spokesperson said: “We are, however, continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required,” per the BBC’s report.
A further statement, reported by The Register, addressed public concern directly: “We understand the potential concern this may cause and want to reassure the public that we have and will continue to take all necessary steps to protect our information and maintain the security of our systems,” the force said. None of the three statements confirms a breach of staff data outright, and none rules it out. That hedged framing is deliberate: confirming a compromise before forensic work is complete could understate or overstate the real exposure, and UK data-protection guidance generally favors accuracy over speed once initial notifications are filed.
The Investigation: Tarian, the ICO, and Outside Specialists
Dyfed-Powys Police is not handling the technical side of this alone. Reporting indicates the force is working with Tarian, the regional organized crime and cybercrime unit covering Wales, alongside external cybersecurity specialists brought in to help scope and remediate the intrusion. The ICO has also been notified, as ITV News separately reported, which is the standard first step under UK GDPR when a data controller believes personal information may be at risk, regardless of whether a compromise is later confirmed.
That structure, a regional cybercrime unit plus outside specialists plus a regulator notification, tracks with how other recent UK public-sector incidents have been handled. It also underscores a resourcing reality: individual police forces, particularly smaller regional ones like Dyfed-Powys, generally do not maintain in-house incident-response teams capable of fully investigating a sophisticated intrusion on their own. They lean on shared regional units and contracted specialists, the same model used across much of local government, where security tooling decisions increasingly start with knowing what is actually running on the network before anyone can respond to an incident, a point echoed in coverage of asset-discovery practices across multi-cloud public-sector environments.
No Attribution Yet: Why the Ransomware Question Remains Open
As of publication, no ransomware group or named threat actor has claimed responsibility for the Dyfed-Powys Police incident, and the force has not confirmed whether ransomware was involved at all. That is a meaningful gap compared with several other 2026 public-sector cases, where extortion groups have gone public quickly to pressure victims into paying. Ransomware crews that operate leak sites, the same playbook used by groups tracked in coverage of the Akira ransomware group’s leak-site listings, typically post a victim’s name within days if payment demands go unmet, so the silence around Dyfed-Powys Police so far could mean several things: negotiations are ongoing, the intrusion did not involve encryption or extortion at all, or the attacker is a different type of actor entirely, such as a state-linked group interested in intelligence rather than a payday.
Without attribution, it is also too early to say whether this incident connects to any broader campaign. UK government departments were hit by the ExfilSquad data-extortion group in July 2026, with the Department for Education, the Ministry of Defence, and the Home Office all named as targets in that wave. Whether Dyfed-Powys Police’s attacker used similar techniques, similar initial access, or is part of the same group is not established in current reporting, and it would be premature to draw that line without confirmation from the force or a named investigator.
Historical Context: Greater Manchester Police’s 2023 Breach
The closest UK precedent for a police-staff data incident is the September 2023 breach affecting Greater Manchester Police (GMP), and it is worth walking through because of how differently that case unfolded once the facts came out.
The Digital ID Supplier Breach
In the GMP case, the attack did not hit the force’s own network directly. It targeted Digital ID, a third-party supplier that produces police identification cards. According to the BBC’s original report on the GMP breach, the incident potentially exposed names, ranks, photographs, and badge serial numbers for thousands of officers and staff, and some of the photographs reportedly carried embedded geolocation data. GMP said financial information and home addresses were not believed to be involved. Early BBC reporting put the number of exposed details above 20,000, though GMP initially declined to confirm how many individual officers were affected while staff notifications were still underway.
NCA’s Response
The BBC reported that the GMP incident was a ransomware attack, and that the National Crime Agency (NCA) led a nationally coordinated criminal investigation into it, reflecting the scale of concern once officer identities and badge data entered the equation. That national-level response is the benchmark against which any staff-data compromise at Dyfed-Powys Police will likely be measured, though current reporting does not show the NCA has taken a similar lead role in the 2026 case, nor is there any confirmed link between the two incidents.
A Pattern: UK Public Sector Under Sustained Pressure in 2026
Dyfed-Powys Police is not an isolated data point this year. An analysis of freedom-of-information responses from 78 English councils found that internally logged data incidents rose 53% between 2021 and 2025, while breaches formally reported to the ICO climbed 41% over the same stretch. In the most recent year covered by that analysis, those councils alone logged 16,902 incidents and made 305 referrals to the regulator.
Central government has not been spared either. The Department for Education was reported to have suffered a hack exposing roughly 607,000 phone numbers and email addresses. In July 2026, the Department for Education, the Ministry of Defence, and the Home Office were all reported as victims of breaches attributed to the ExfilSquad data-extortion group. And in August 2026, the ICO issued an enforcement notice and a formal reprimand against the Metropolitan Police Service after failures led to sensitive personal information being disclosed in two separate cases, including unredacted documents and a bulk email that exposed individuals’ identities. That Met Police matter was a data-handling failure rather than an external intrusion, but it lands in the same regulatory conversation, and it shows the ICO is willing to act against policing bodies specifically. Government hackers hunting for records at scale are not limited to central departments either, as shown by reporting on state-linked actors extracting 18,566 government records through a WordPress and Zyxel chain elsewhere this year.
How This Incident Compares to Recent UK Public-Sector Breaches
The table below lines up what is confirmed about the Dyfed-Powys Police incident against other named UK public-sector cases from the past three years. Figures marked “not disclosed” reflect gaps in current public reporting, not a confirmed absence of impact.
| Organization | Year | What Happened | Confirmed Scale | Source |
|---|---|---|---|---|
| Dyfed-Powys Police | 2026 | Cyberattack disrupted non-emergency systems; staff-data access under investigation | Not disclosed as of Sept. 25 | BBC |
| Greater Manchester Police (via Digital ID supplier) | 2023 | Ransomware attack on ID-card supplier exposed officer badge data | 20,000+ details potentially at risk; NCA-led probe | BBC |
| Metropolitan Police Service | 2026 | ICO enforcement notice and reprimand over unredacted documents, bulk email exposure | Two confirmed disclosure cases; regulatory reprimand | ICO reporting |
| Department for Education | 2026 | Hack exposed contact records | ~607,000 phone numbers and email addresses | Reporting cited via Perplexity research |
| DfE, Ministry of Defence, Home Office | 2026 (July) | Breaches attributed to ExfilSquad data-extortion group | Three departments named as victims | Reporting cited via Perplexity research |
| 78 English councils (aggregate) | 2021-2025 | Rising internally logged data incidents and ICO referrals | 16,902 incidents and 305 ICO referrals in latest year; +53% incidents, +41% ICO referrals since 2021 | FOI-based analysis |
Market Impact: What This Means for Public-Sector Cybersecurity Budgets
Every confirmed policing or government breach this year adds to a case that budget-holders inside the Home Office, the Welsh Government, and individual police and crime commissioner offices cannot easily ignore. Regional forces like Dyfed-Powys typically run leaner IT security budgets than national agencies or large metropolitan forces, and they depend heavily on shared regional units such as Tarian rather than dedicated in-house security operations centers. A confirmed staff-data compromise, even a modest one, tends to accelerate spending decisions that had been sitting in a business case for months.
Insurance and Compliance Pressure
A new UK government protocol introduced in July 2026 requires that breaches reported to the ICO also be reported in parallel to the Cabinet Office’s Government Security Group incident-response team and the government’s data-protection team at the Department for Science, Innovation and Technology (DSIT). If Dyfed-Powys Police’s incident falls under that reporting chain, it means the Cabinet Office and DSIT already have visibility into the case beyond what has been made public, and any policy response, whether that is new funding, new standards for regional forces, or a wider audit, is more likely to move faster than it would have before that protocol existed.
Policing vs. Central Government vs. Local Councils on Cyber Readiness
Comparing how different tiers of UK public administration have handled disclosure and response in 2026 shows a split between bodies that lead with a national investigative agency and those that rely on regional or internal resources.
| Tier | Typical Incident-Response Model | Regulator Involvement | 2026 Example |
|---|---|---|---|
| Regional policing | Regional cybercrime unit (e.g., Tarian) plus external specialists | ICO notified | Dyfed-Powys Police |
| Metropolitan/national policing | Larger in-house capability; NCA can lead on major criminal cases | ICO enforcement action possible | Metropolitan Police Service reprimand; GMP’s NCA-led 2023 probe |
| Central government departments | Departmental security teams plus Cabinet Office Government Security Group | ICO plus parallel Cabinet Office/DSIT reporting under 2026 protocol | DfE, MoD, Home Office ExfilSquad breaches |
| Local councils | Varies widely by council size and budget | ICO referrals rising sharply | 78-council FOI analysis showing 53% incident growth |
The pattern that emerges is one of fragmentation. Larger bodies with national remits, the Metropolitan Police, the NCA, central departments, have more formal escalation paths and more consistent regulator engagement. Smaller, regional bodies like Dyfed-Powys Police or individual councils depend on shared units and case-by-case decisions about when and how much to disclose. That structural gap is one reason security researchers have pushed public-sector IT teams toward building security in as a foundational layer for backend systems rather than bolting it on after deployment, a theme covered in depth in analysis of where API security controls actually belong in a backend stack.
What Named Sources Are Saying
Beyond the force’s own statements, the incident is being read by outside observers as another data point in a broader trend of attackers treating public-sector targets, including law enforcement itself, as viable ground. That framing lines up with how other 2026 cases involving law-enforcement-adjacent data have played out, including reporting on threat actors claiming to have accessed FBI-linked material, covered in detail in coverage of the ShinyHunters group’s claims around FBI data. Whether or not that specific group has any connection to the Dyfed-Powys Police case, the broader signal is the same: law enforcement agencies are no longer treated as off-limits by attackers, and staff records inside those agencies carry a kind of value, both financial and operational, that makes them worth pursuing.
The Dyfed-Powys Police spokesperson’s repeated emphasis on “all appropriate steps” and “all necessary steps” to protect information, as quoted by the BBC and The Register respectively, reflects a communications posture common to early-stage breach disclosures: reassure without overpromising, and leave room for the investigation’s findings to shift the story in either direction.
What Happens Next: Five Predictions
Based on how comparable UK public-sector incidents have played out in 2026 and in the 2023 GMP case, here is how this story is likely to develop over the coming weeks:
- Dyfed-Powys Police will likely issue a follow-up statement within two to four weeks confirming or ruling out staff-data compromise, following the disclosure cadence seen in the GMP case, where confirmation of scope took time even after the initial announcement.
- If staff data is confirmed compromised, expect direct notifications to affected employees and potential involvement from the Police Federation of England and Wales or an equivalent staff body, given the sensitivity of officer identity data.
- Regulatory attention will likely increase. Given the ICO’s willingness to act against the Metropolitan Police Service in August 2026, a confirmed breach at Dyfed-Powys Police raises the odds of at least an ICO inquiry, even if a formal enforcement notice is not guaranteed.
- Pressure will build on the Home Office and the National Police Chiefs’ Council to publish a clearer national picture of cyberattacks against UK police forces, an area where current public reporting remains fragmented across individual incidents rather than a consolidated tally.
- Expect the new Cabinet Office/DSIT parallel-reporting protocol introduced in July 2026 to be cited more often in future incidents, as bodies at every tier, from regional forces to central departments, adjust to a disclosure environment with more overlapping obligations than existed just a year ago.
Frequently Asked Questions
Which police force was hit by the cyberattack reported on September 25, 2026?
Dyfed-Powys Police, the territorial force covering Carmarthenshire, Ceredigion, Pembrokeshire, and Powys in mid and west Wales, confirmed the incident, according to the BBC.
When did the attack actually happen?
The force said it identified the cyberattack on September 14, 2026, and confirmed it publicly 11 days later, on September 25, 2026.
Was the public’s personal data affected?
Dyfed-Powys Police said its investigation had so far found no evidence that members of the public’s personal data had been accessed or compromised.
What information might have been compromised?
The force said it is investigating whether information relating to its own staff may have been accessed. It has not specified which data fields, such as names, contact details, or payroll records, might be involved.
Did the attack affect 999 and 101 emergency lines?
No. The force said the disruption was limited to some non-emergency systems, including online and email contact services, which were temporarily unavailable before being restored.
Who is investigating the incident?
Reporting indicates Dyfed-Powys Police is working with Tarian, the regional cybercrime unit for Wales, along with external cybersecurity specialists. The force has also notified the ICO, following the same breach-reporting process the regulator requires of any UK data controller when personal data may be at risk.
Has any ransomware group claimed responsibility?
No group or threat actor has publicly claimed the attack as of this report, and the force has not confirmed whether ransomware was involved.
How does this compare to the 2023 Greater Manchester Police breach?
The 2023 GMP case involved a ransomware attack on a third-party ID-card supplier that potentially exposed more than 20,000 officer and staff details, including badge data, and was investigated by the National Crime Agency. The Dyfed-Powys Police case has not been confirmed as ransomware, has not had a scale disclosed, and current reporting does not show NCA involvement, though the two cases are not confirmed to be connected.
Related Coverage
- ShinyHunters Say They Hacked FBI, Hold 2-3TB Data [2026]
- ZcopyReaper Linux Bug Hits CVSS 7.8, Root Since 2018 [2026]
- Google Fined €403M Over Location Data Privacy [2026]
- Norton 360 for Gamers vs Bitdefender vs Malwarebytes: 3% FPS Gap [2026]
- AI Hacking Costs Drop to $25 a Company: Inside the Math [2026]
