The UK inspectorate of police and fire services (HMICFRS) says in a report that technology suppliers handling police data were repeatedly breached between 2021 and 2025, without a direct attack on police systems themselves. The public report does not name suppliers or forces, nor say how many attacks occurred or whether data was stolen. It finds that most contracts do not provide for ongoing checks on suppliers' cybersecurity. Police IT teams also often have no access to suppliers' logs.

What it means: The report describes a problem that is not only British. Organisations invest in securing their own systems, but their data increasingly sits with software, cloud and support suppliers that are checked only when the contract is signed, if at all. When an organisation cannot see a supplier's logs, a breach can go unnoticed or come to light very late. In Greece, the NIS2 directive, now part of national law, requires the bodies it covers to manage supply chain risk explicitly, and the DORA regulation does the same for the financial sector. In practice this means contracts with a duty to report incidents promptly, audit rights, minimum security requirements and access to logs when needed. For public bodies and businesses, a practical first step is to list every supplier that holds sensitive data and rank them by risk. Treating security as an ongoing obligation rather than a one-off questionnaire is the report's main message.

Read the original on The Record

Related service: Custom software

Related stories