His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a report on Tuesday 27 October 2026 finding that hackers have repeatedly compromised third-party suppliers holding British police data since 2021, The Record reported.

According to The Record, the inspectorate said the Police Digital Service and the National Police Chiefs' Council shared "information on multiple cyberattacks" affecting "third-party ICT supply chains which held police information", but the report does not say how many attacks took place, which suppliers or forces were affected, or whether data was stolen, and the inspectorate said it removed operational details it considered unsuitable for the public domain.

The Record reports the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 "near misses", and warned that police data held on suppliers' systems is among the sector's biggest risks because it sits outside its monitoring. Inspectors found most police supplier contracts included no ongoing cybersecurity assurance, that in some cases staff could not say whether suppliers had to report incidents promptly, and that in several organisations supplier-held system logs were not routinely visible to in-house teams, according to The Record.

The inspectorate also criticised the government for leaving policing and fire services out of the National Risk Register 2025, the Government Cyber Action Plan and the Cyber Security and Resilience Bill.

"A major cyberattack is not a hypothetical scenario," said His Majesty's Inspector of Constabulary Michelle Skeer, as quoted by The Record.

The Record says neither the Home Office nor the National Police Chiefs' Council responded to questions about whether police data was compromised in the supplier attacks. Wire: The Record (27 Oct). The HMICFRS page could not be read by this desk.