UK watchdog finds police and fire cyber risk outpacing defenses
First merged summary.
HMICFRS says UK police and fire cyber risk is rising faster than controls, citing supplier attacks, legacy systems and 13 fixes.
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services published findings on October 27 warning that cyber risk to UK police forces and fire and rescue services is rising faster than many organizations’ response. A three-phase inspection from January to May 2026 reviewed more than 260 documents and found gaps in legacy ICT, supplier risk, backups, access control, senior accountability and national coordination. The Police Digital Service and National Police Chiefs’ Council reported multiple cyberattacks since 2021 on suppliers holding police information; operational details were withheld, and neither the Home Office nor the chiefs’ council said whether police data was compromised. Policing recorded 252 cybersecurity incidents and 796 near misses in the first three months of 2026. HMICFRS issued 13 recommendations, including baseline standards, Cyber Essentials for suppliers and a national fire-service capability.
- January–May 2026 inspection reviewed more than 260 documents.
- 13 recommendations cover standards, supplier Cyber Essentials and a national fire capability.
- 252 incidents and 796 near misses recorded in the first three months of 2026.
- Most supplier contracts lacked ongoing security assurance, inspectors said.
- Policing and fire services were omitted from the Cyber Security and Resilience Bill.
- A 2023 Digital ID ransomware attack exposed Metropolitan Police officer and staff details.
Timeline
dated events in the reporting · oldest first- Oct 27, 2026HMICFRS publishes police and fire cybersecurity inspection. · Infosecurity Magazine
What each outlet adds
beyond the shared facts- Infosecurity MagazineInspection scope, 13 recommendations and leadership accountability gaps.
- The RecordSupplier breaches since 2021, incident counts and withheld compromise answers.
Coverage
oldest first · one row per article · UTC- · 3d ago
Infosecurity MagazineFirst report
UK inspectorate urges police and fire services to harden cybersecurity
A January–May 2026 inspection found legacy systems, weak third-party controls and uneven national coordination.
- · 3d ago
The Record
Suppliers holding UK police data repeatedly breached since 2021
The inspectorate withheld which suppliers and forces were hit and does not say whether those attacks stole data.