Greater Manchester police officers’ data hacked in cyber-attack

Details of thousands of officers may have been taken in ransomware attack on third-party supplier

The personal details of tens of thousands of public sector workers could have been breached in a cyber-attack that has hit two of Britain’s biggest police forces, an expert has said.

More than 12,500 Greater Manchester police (GMP) officers and staff were put on alert on Thursday that their private data had been compromised in a hack that also hit the Metropolitan police last month.

The details of officers’ warrant cards – including names, ranks, photos and serial numbers – are thought to have been taken in the ransomware attack on a third-party supplier used by both forces.

The National Crime Agency (NCA) said it had launched a criminal investigation into the breach at the Stockport-based firm, Digital ID, which makes identity cards and lanyards for a number of UK organisations including several NHS trusts and universities.

Toby Lewis, a former incident manager at the National Cyber Security Centre, said it was likely that details of staff in other organisations that the firm supplies would also have been compromised. The firm insisted the majority of its customers were not affected.

In a sign of the seriousness of the attack, the NCA said it was working alongside the National Crime Security Centre and the Information Commissioner’s Office “to fully understand the impact of the incident and support those organisations whose data has been accessed”.

Lewis, now head of threat analysis at the cybersecurity firm Darktrace, said it likely that the firm’s entire customer base would have been hacked.

He said: “If you’ve got a pass that’s been made by Digital ID then there is absolutely is the chance that your personal details that were used to generate that pass [have] been caught up in this ransomware attack and could eventually be leaked online if the company chooses not to pay the ransom.”

Asked if this could run into tens of thousands of people, Lewis stressed he did not know the size of the company’s database, but he added: “Given their clients, you could be talking those kind of numbers.”

Digital ID said it notified cyber experts last month when it became aware of the incident. The company says most of its clients buy its printers and then produce identity cards at their own offices, meaning they are not transferring huge amounts of employee data to a third party. The BBC is understood to be one such client.

However, a small number of other customers – understood to include the Metropolitan police and GMP – provide employee data to Digital ID so the firm can print the cards for them.

A source said most of these identity cards were inactive when they left Digital ID’s headquarters. However, it appears that cyber-attackers have been able to access this data through its systems.

The breach will prompt serious security concerns given the highly sensitive nature of police work at the two forces, which together employ more than 60,000 officers and staff and have the busiest counter-terrorism units in Britain.

It will raise further questions about data protection in UK policing, coming just weeks after the surnames and initials of 10,000 Police Service of Northern Ireland employees were published online after being accidentally included in a response to a freedom of information request.

The Police Federation has said it alerted the Metropolitan police to the potential dangers of outsourcing operationally sensitive material three years ago.

Mike Peake, the chair of the Greater Manchester Police Federation, said officers would rightly be concerned by the latest security breach. He said: “Our colleagues are undertaking some of the most difficult and dangerous roles imaginable to catch criminals and keep the public safe. To have any personal details potentially leaked out into the public domain in this manner – for all to possibly see – will understandably cause many officers concern and anxiety. We are working with the force to mitigate the dangers and risks that this breach could have on our colleagues.”

GMP is facing questions about why it first told staff about the incident on Wednesday, almost three weeks after the breach became public.

In an email to staff, the force said investigators had established that data from the badges including names, ranks, photos and serial numbers “may have been accessed”.

It said some of these photos contained “geo-location data” – information that discloses where precisely the picture was taken or from where it was uploaded – and that these people were being contacted.

There was no indication at this stage that any personal information had been published online, according to the email, which was shared with the Manchester Evening News.

Any identifiable police data would be highly valuable to criminals as it could be used to steal impersonate officers, steal their identities or disrupt investigations.

A number of GMP’s 8,000 officers work in undercover roles, meaning their personal details being stolen presents a significant risk to their safety and the covert inquiries on which they work.

Colin McFarlane, an assistant chief constable of Greater Manchester police, said: “We are aware of a ransomware attack affecting a third-party supplier of various UK organisations, including GMP, which holds some information on those employed by GMP. At this stage, it’s not believed this data includes financial information.

“We understand how concerning this is for our employees so, as we work to understand any impact on GMP, we have contacted the Information Commissioner’s Office and are doing everything we can to ensure employees are kept informed, their questions are answered and they feel supported. This is being treated extremely seriously, with a nationally led criminal investigation into the attack.”

Elizabeth Baxter, the head of cyber investigations at the Information Commissioner’s Office, said: “Police officers and staff expect their information to be kept secure, and are right to be concerned when that doesn’t happen. This incident has been reported to us, and we’ll now be looking into what happened, and asking questions on behalf of anyone affected.”


Josh Halliday and Matthew Weaver

The GuardianTramp

Related Content

Article image
Prosecute officers, says Greater Manchester abuse whistleblower
Comments come as report finds police failings allowed many abusers to escape justice

Amy Walker

14, Jan, 2020 @3:48 PM

Article image
Greater Manchester police to be placed in special measures
Inspectors had expressed ‘serious cause for concern’ after force failed to record a fifth of all reported crimes

Helen Pidd North of England editor

17, Dec, 2020 @7:59 PM

Article image
Manchester police chief opposes officers routinely carrying guns
Ian Hopkins speaks out even though his force’s armed unit was increased by a third after Manchester Arena attack

Helen Pidd North of England editor

17, May, 2018 @4:46 PM

Article image
Personal data stolen in British Library cyber-attack appears for sale online
Ransomware group Rhysida claims responsibility for hack and has posted images from library’s HR files

Harriet Sherwood Arts and culture correspondent

22, Nov, 2023 @12:40 PM

Article image
Police apologise for 'Allahu Akbar' use in mock Manchester attack
Greater Manchester police say it was unacceptable to use religious phrase immediately before fake suicide bombing

Frances Perraudin

10, May, 2016 @1:05 PM

Article image
Greater Manchester police gave 'slap on the wrist' cautions for rapes
Police and crime commissioner demands answers after FoI request reveals cautions handed out for string of serious crimes

Nazia Parveen North of England correspondent

09, Nov, 2016 @1:21 PM

Article image
Greater Manchester police under real strain due to cuts, says chief
Chief constable tweets table showing cuts to staffing numbers, after weekend policing protests, festival and bombing inquiry

Helen Pidd North of England editor

12, Jun, 2017 @8:30 AM

Article image
Campaign to oust police from schools in Greater Manchester gathers pace
Teaching unions say plans for more officers will risk criminalising young people

Nazia Parveen Community affairs correspondent

22, Jun, 2021 @10:37 AM

Article image
Police to bolster venue security nationwide after Manchester attack
Humberside, Metropolitan and South Wales police among forces to announce tighter measures after suicide blast

Damien Gayle

23, May, 2017 @5:57 PM

Article image
Greater Manchester police chief vows to quit if force not better in two years
Stephen Watson says officers will visit all burglary scenes in drive to improve ‘underperforming’ force

Helen Pidd North of England editor, and agencies

27, May, 2021 @3:48 PM