Dyfed-Powys investigates possible staff data breach after cyber attack
Dyfed-Powys Police is investigating whether staff information was accessed or compromised during a cyber incident which disrupted some of the force’s non-emergency systems.
The force said the incident was identified on 14 September and that there was currently no evidence that personal data belonging to members of the public had been accessed or compromised.
However, an investigation is continuing into whether information relating to police officers and staff may have been accessed. The force said it had taken “precautionary measures” affecting its systems while specialist teams investigated the incident and worked to restore services safely.
Its online and email contact services were unavailable for a period following the incident but have now been restored.
The force said its emergency response was not affected, with both 999 and 101 telephone services remaining operational throughout. The Information Commissioner’s Office has been notified.
The investigation is being managed by Tarian, the regional cyber-crime unit, with support from cyber-security specialists.
A Dyfed-Powys Police spokesperson said: “At this stage, our investigation has found no evidence that members of the public’s personal data has been accessed or compromised as a result of this incident.
“We are, however, continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required.”
The force said it remained fully operational and was continuing to monitor its systems closely.
Graeme Stewart, head of public sector at cyber-security company Check Point, warned that the potential compromise of staff information could itself pose a significant security risk. “Police staff data can be hugely valuable to an attacker,” he said, citing information such as names, roles, contact details and internal organisational information that could potentially be used for phishing or impersonation attacks.
He said the investigation would need to establish how attackers gained access, how far they moved through the network and what information they were able to access. “The disruption to non-emergency systems also tells us this was not trivial,” he said.
Dyfed-Powys Police serves Carmarthenshire, Ceredigion, Pembrokeshire and Powys.
The force said it would provide further updates when it was in a position to do so.