Government Data Breach: PNLD Misconfiguration Exposes UK Police Force Contact Directories
Executive Summary
The Police National Legal Database (PNLD)—the official legal information platform supporting all 43 Home Office police forces in the United Kingdom—confirmed a major data security breach on August 3, 2026. Threat intelligence group VenariX and security researchers confirmed that extortion group ExfilSquad exfiltrated structured database exports containing official contact details, badge numbers, email addresses, and administrative accounts for over 108,000 UK police officers and support personnel. The breach resulted from misconfigured access controls within PNLD's cloud-hosted Microsoft Power Platform / Dataverse backend architecture.
Technical Analysis of the PNLD Power Platform Dataverse Exposure
Forensic investigations revealed that the exposure stemmed from over-permissive API permissions in cloud database environments:
1. Microsoft Power Platform OData Anonymous Access Misconfiguration
The breach leveraged default or misconfigured access policies within Microsoft Dataverse tables:
* Anomalous OData Queries: Attackers identified public-facing Microsoft Power Apps endpoints (content.powerapps.com) linked to PNLD's online database.
* Anonymous Read Permissions: Due to misconfigured table permissions within the Dataverse environment, anonymous web requests were permitted to execute OData REST queries against internal tables, retrieving structured JSON records without authentication.
2. Scope of Exfiltrated Police Directories
The stolen dataset exfiltrated by ExfilSquad includes sensitive government personnel entries:
* Exfiltrated Data Fields: Full names, official email addresses, UK police force branch affiliations, badge numbers, internal phone extensions, and administrative contact registries.
* Incident Response & Regulatory Notification: PNLD notified the UK Information Commissioner's Office (ICO) and National Crime Agency (NCA), taking vulnerable Power Platform portals offline to restrict anonymous API access.
Breach Metric
Details
Victim Organization
Police National Legal Database (PNLD) / UK Home Office Police Forces
Disclosed Date
August 3, 2026
Affected Personnel
108,000+ UK Police Officers & Support Staff Across 43 Forces
Primary Attack Vector
Microsoft Power Platform / Dataverse Anonymous OData Permission Misconfiguration
Exfiltrated Assets
Officer Full Names, Badge Numbers, Email Addresses, Internal Contact Directories
Cloud Low-Code Platform Security Governance Risks
The PNLD breach highlights severe security risks associated with rapid low-code / no-code cloud platform adoption. When organizations deploy Microsoft Power Apps or Dataverse solutions without rigorous security review, default table settings can inadvertently expose sensitive internal databases to public REST API scraping.
Securing low-code cloud platforms requires continuous auditing of API permission boundaries and data exposure policies.
Recommendations and Mitigations
Organizations utilizing Microsoft Power Platform, Dataverse, and low-code cloud services must implement strict security controls:
1. Disable Anonymous Access on Microsoft Dataverse Tables: Audit all Dataverse table permissions and enforce strict authentication requirements for OData API access.
2. Implement Automated Power Platform Security Scanners: Utilize Microsoft Power Platform CLI security tools to continuously detect publicly accessible tables or overly permissive web APIs.
3. Conduct External Attack Surface Scans for Cloud Portals: Scan all public-facing content.powerapps.com endpoints for unauthenticated data leakage.
4. Issue Phishing Advisories for Impacted Personnel: Warn exposed police personnel regarding targeted spear-phishing, credential harvesting, and social engineering attempts.