What Happened
Between 2021 and early 2025, multiple cyberattacks compromised third-party suppliers holding British police data, as reported by His Majesty's Inspectorate of Constabulary and Fire & Rescue Services. The Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2025, along with 796 near misses. Although operational details were withheld, it was confirmed that suppliers holding police information on victims, safeguarding, intelligence, and investigations were breached. Most police supplier contracts lacked ongoing cybersecurity assurance, and in some cases, staff couldn't confirm whether suppliers were required to report incidents promptly.
Timeline
2021-2023: Multiple cyberattacks on third-party suppliers holding police data occurred. Notable incidents included a 2023 ransomware attack on ID card maker Digital ID, which exposed Metropolitan Police officer details and led to the theft of thousands of Greater Manchester Police officers' names and photos.
July 2024: The Police National Legal Database, used by every force in England and Wales, confirmed hackers stole contact details of officers and staff.
September 2024: Dyfed-Powys Police disclosed a cyberattack that disrupted non-emergency systems and may have compromised staff information.
January, March 2025: The Police Digital Service recorded 252 cybersecurity incidents in this quarter alone, including malware attacks, unauthorized access attempts, and accidental disclosures.
April 2025: The inspectorate published its findings, warning that supplier-held data sits outside national monitoring capabilities and represents one of the sector's biggest risks.
Which Controls Failed or Were Missing
The failures cluster around three control domains:
Supplier security assessment and monitoring: Most contracts lacked ongoing cybersecurity assurance mechanisms. Organizations couldn't demonstrate continuous evaluation of supplier security posture. System logs held by suppliers weren't routinely visible to police IT teams, creating blind spots in threat detection.
Contractual security requirements: Staff in several organizations couldn't confirm whether suppliers were contractually obliged to report incidents promptly. Contracts apparently lacked specific incident notification timelines, escalation procedures, or security audit rights.
Information asset visibility: The Police Digital Service identified that data held on supplier systems sits outside its national security operations center monitoring. Organizations didn't maintain adequate visibility into where sensitive data resided or how suppliers protected it.
What the Relevant Standards Require
ISO/IEC 27001:2022 addresses these failures directly through multiple controls:
Clause 5.19 (Information security in supplier relationships) requires organizations to define and agree on information security requirements with suppliers, monitor supplier service delivery, and manage changes to supplier services. This isn't a one-time contract checkbox. You need documented processes for ongoing supplier assessment.
Clause 5.20 (Addressing information security within supplier agreements) mandates that relevant information security requirements be established and agreed with each supplier. The control explicitly calls for addressing access to organizational assets, security incident management and reporting, and the right to audit supplier compliance.
Clause 5.21 (Managing information security in the ICT supply chain) extends these requirements across the supply chain. When your supplier uses subcontractors to process your data, you're responsible for ensuring security requirements flow through.
Clause 8.16 (Monitoring activities) requires organizations to monitor, measure, analyze, and evaluate information security performance. For supplier-held data, this means you need log visibility, not trust-based relationships.
ISO/IEC 27036 provides additional implementation guidance for supplier relationships. It emphasizes that information security requirements must be maintained throughout the supplier lifecycle, not just at contract signing.
For SOC 2 organizations, the Common Criteria include CC9.1 (vendor management) and CC9.2 (monitoring vendor controls). If you're processing sensitive data through suppliers, your auditor will ask how you monitor their security posture between assessments.
Lessons and Action Items for Your Team
Map where your sensitive data actually lives. The Police Digital Service identified supplier-held data as a top risk specifically because it sits outside their monitoring. Document which suppliers hold what categories of data. If you can't produce this inventory in 30 minutes, you have a gap.
Rewrite your supplier security requirements. Your contracts need:
- Specific incident notification timelines (not "promptly" but "within 4 hours of detection")
- Right-to-audit clauses with defined frequency and scope
- Security control requirements mapped to your own compliance framework
- Breach notification procedures with named contacts
- Subcontractor approval requirements
Implement continuous supplier monitoring. Annual security questionnaires don't cut it. Require suppliers to:
- Share relevant system logs with your security operations team
- Provide monthly or quarterly security posture reports
- Grant read-only access to their security monitoring dashboards for critical suppliers
- Participate in tabletop exercises covering incident scenarios
Build supplier incident response into your playbooks. When inspectors found that staff couldn't confirm whether suppliers were obliged to report incidents promptly, that's a process failure. Your incident response plan needs a supplier breach scenario with defined escalation paths, evidence preservation steps, and communication protocols.
Review your risk register. If you haven't formally assessed third-party risk in the past 12 months, you're operating on outdated assumptions. The 252 incidents in 90 days suggest the threat landscape has shifted. Update your scenario-based risk assessments to include supplier compromise.
Test your contract enforcement. Pick three critical suppliers and verify:
- Can you actually exercise your audit rights?
- Do you receive the logs specified in the contract?
- Have they completed required security assessments this year?
- Do they know who to contact if they detect an incident?
If you discover gaps, document them as nonconformities in your next management review. Supplier risk isn't theoretical when attackers are actively targeting the supply chain. The UK police incidents show what happens when contract management treats security as a procurement formality rather than an operational control.
