Government Cloud Misconfiguration: U.K. Police Legal Database Exposes Sensitive Directories via PowerApps
Executive Summary
On August 3, 2026, security researchers confirmed a significant data breach affecting the Police National Legal Database (PNLD) in the United Kingdom. A misconfigured public cloud asset hosted on Microsoft's PowerApps domain (content.powerapps.com) leaked unencrypted contact directories containing personal details of UK police officers, judicial personnel, and government legal advisors.
Deep-Dive Technical Analysis
The exposure resulted from improper access control configuration within a Microsoft PowerApps Portals asset linked to Microsoft Dataverse backend tables:
* Anonymous REST API Access: The portal configuration inadvertently permitted anonymous public access to OData/REST API feeds backing user directories.
* Dataverse Table Exposure: Unauthenticated web requests sent to content.powerapps.com endpoints allowed scrapers to query internal user entity tables without requiring active tenant credentials.
Extracted datasets contained full names, official email addresses, direct phone extensions, force department assignments, and internal security role designations for thousands of personnel. Security analysts confirmed that while sensitive case evidence remained isolated, the exposed directories provided comprehensive operational maps of UK law enforcement legal teams.
Industry Impact & Recommendations/Mitigations
Exposing law enforcement contact directories introduces significant risks of targeted spear-phishing, credential harvesting, social engineering, and potential physical harassment against judicial and police personnel.
Recommended Mitigations:
1. Disable Anonymous Access: Audit and disable anonymous read/query permissions across all Microsoft PowerApps Portals and Dataverse table definitions.
2. Implement Power Platform Governance: Deploy tenant-wide Power Platform Data Loss Prevention (DLP) policies to restrict external endpoint exposure.
3. Enforce MFA and IP Restrictions: Enforce strict Azure AD Conditional Access policies mandating multi-factor authentication (MFA) and IP whitelisting for all administrative portal interfaces.
4. Personnel Vigilance Training: Alert affected legal and law enforcement staff to expect sophisticated spear-phishing attempts leveraging the leaked contact details.