Personal details of British police officers breached in a supplier’s cyber attack

Sensitive details of serving police officers within at least one British force have been stolen after an attack on one of their suppliers. 

The supplier, who provide ID badges, was targeted in an attack. Stolen details include the names, photos and identity numbers of officers. 

This attack once again highlights how serious the implications can be when data breaches occur within suppliers. In this case, there are concerns that the identities of undercover officers could be revealed.

As with other supply chain incidents, the end organisation (in this case, at least one police force) was not breached themselves. British police forces adhere to a very high level of security meaning that they are not an attractive direct target for threat actors.

Suppliers remain a black hole of security risk

Although many organisations have an understanding of their own security levels, the same cannot be said for their suppliers. Only 13% of British businesses track cyber risks among their supply chain (UK Government statistic) and even then, it is primarily through self-attestation in the form of questionnaires. 

This means that even among companies who do attempt to measure their third party cyber risk levels, they are heavily reliant upon suppliers to be aware and honest. Crucially, this doesn’t just rely upon the organisation’s level of awareness but on the awareness of the person completing the form. 

Without possessing a true picture of cyber risk levels, organisations have no measure of their risk exposure. 

Any data is valuable to attackers

This cyber attack and subsequent data breach has caused concern for the safety of employees within at least one British police force. It is one of several attacks in recent times to expose personal details of organisations’ employees. 

Another recent high profile attack was against the MOVEit platform in June. The platform was used by suppliers - including a popular HR and Payroll platform. It exposed personal details including addresses and national insurance numbers of employees as organisations including the BBC, two airlines, a national retailer, a university and others.

Information about people (employees and customers) is valuable to attackers because it can be used in acts of fraud. Targeting suppliers who hold this information is often more effective than targeting the organisation themselves. Partly because suppliers have several clients (so store details of more people) and partly because they are often less secure than their larger clients. 

Personal details of people is not the only kind of information that threat actors target. Earlier this month (September 2023), a Russian-speaking group called LockBit targeted the supplier of fences to Britain’s nuclear submarine base and several prisons. This breach caused a degree of security concerns and a significant amount of negative media coverage. 

Supplier cyber risks can be measured and controlled

Despite the perception of cybersecurity risks being complicated, time-consuming and expensive to assess; it is very possible to gain a quick understanding of third-party cyber risk levels. 

Darkbeam makes this possible by automating the vulnerability assessment process of every supplier in a supply chain and continuously monitoring for threats against and data breaches from any supplier with access to sensitive information. 

Try Darkbeam’s platform for free or fill in the form below to speak to a member of our team. We will show how managing cyber risk among suppliers is fast, efficient, affordable and scalable - all within a simple platform which takes less than an hour to onboard.