A police cyber attack threat has prompted an urgent warning to police forces and fire and rescue services. Inspectors found that many organisations in England and Wales are not fully prepared for a significant and growing cyber risk.
His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services, known as HMICFRS, published its thematic inspection report on 27 October 2026. It calls for urgent improvements to resilience across services that hold sensitive information and support essential public safety operations.
Police cyber attack threat detailed by HMICFRS
The inspection examined how police forces and fire and rescue services manage cybersecurity risks. Its evidence came from a sample of three police forces and three fire and rescue services in England and Wales.
HMICFRS first published the terms of reference for the thematic inspection on 8 December 2025. The resulting report, titled Cybersecurity in police forces and fire and rescue services, was released alongside a news statement on 27 October 2026.
The warning does not announce a newly discovered breach, malware campaign or software vulnerability. Instead, it describes systemic weaknesses that could allow cyber attacks to cause operational disruption, expose sensitive data or make recovery slower and more expensive.
HMICFRS concluded that the police cyber attack threat is significant and growing. Although the maturity of security arrangements varied, the inspection found that preparedness, resilience and recovery controls were not consistently strong enough across the organisations examined.
Legacy technology ranked as the highest strategic risk
Senior leaders consulted during the inspection identified legacy ICT as their highest strategic cybersecurity risk. Ageing systems can be difficult to patch, may depend on unsupported components and can prevent organisations from adopting modern security controls.
Legacy technology can also create complex operational dependencies. A vulnerable system may remain in use because it supports a critical process, integrates with specialist equipment or cannot be replaced without an extensive migration project.
The inspectorate therefore placed ICT modernisation among the main priorities for reducing the police cyber attack threat. This is not simply a question of buying newer technology. Services must understand which systems are most critical, how they connect and what would happen if they became unavailable.
Third-party suppliers present additional exposure
The report also raised concerns about contractors that manage technology or store sensitive police data. An organisation may maintain strong internal controls but still face exposure if a supplier has excessive access, weak security practices or inadequate recovery arrangements.
Supplier-managed platforms can hold operational information, employee records and other sensitive data. Compromise of one provider could therefore affect more than one force or service, particularly where the same technology is widely used.
No specific suppliers, software products, versions or platforms were identified. The warning is not linked to a CVE, a proof of concept or a single exploitable flaw. No indicators of compromise were published with the HMICFRS report.
Identity, password and recovery weaknesses identified
Human and administrative controls formed another important part of the findings. Examples included weaknesses in joiners, movers and leavers processes, poor password management and inconsistent use of multi-factor authentication.
Joiners, movers and leavers controls govern how access is created, changed and removed as people enter an organisation, change roles or depart. Weaknesses can leave dormant accounts active, allow employees to retain unnecessary privileges or delay the removal of supplier access.
Multi-factor authentication provides an additional barrier when a password is stolen or guessed. Its inconsistent use means that access to some systems may still depend on a password alone, increasing the chance that phishing or reused credentials could lead to unauthorised access.
The inspection found that monitoring and detection capabilities were improving, but progress was inconsistent. Detecting an incident is only one part of resilience, as organisations must also be able to contain disruption and restore essential systems safely.
Some backup capabilities were unsatisfactory
Recovery arrangements were a significant concern. In some inspected organisations, backup capabilities intended to support recovery after a breach were graded unsatisfactory.
Backups can fail to provide effective protection if they are incomplete, accessible from compromised accounts or not regularly tested. For emergency services, delays in restoring systems may affect non-emergency operations, administrative functions, data access and communication with partner organisations.
The findings indicate that preparation was not consistently embedded across the sample. HMICFRS said national frameworks provide support, but they have not produced sufficient or uniform resilience across every police force and fire and rescue service.
Successful attacks show the threat is active
The warning is based on more than a theoretical assessment. HMICFRS said successful cyber attacks have already affected police forces and fire and rescue services, causing disruption, creating risks to the public and requiring costly remediation.
A recent example involved Dyfed-Powys Police. The force identified a cyber attack on 14 September 2026 and disclosed it publicly on 25 September 2026. The incident disrupted non-emergency systems, and the force said staff information may have been at risk, although emergency response remained unaffected.
That incident is not presented as the cause of the thematic report, which had already been commissioned. However, it illustrates how the police cyber attack threat can affect real services without necessarily disabling emergency response functions.
The national policy context also reflects the seriousness of the issue. The report notes that cyber risk was elevated in the National Risk Register 2025 and that the Government Cyber Action Plan updated the National Cyber Strategy in 2026.
Sector consideration of the findings began immediately after publication. A Derbyshire Fire and Rescue Service governance paper recorded the thematic report and scheduled a service update for a committee meeting on 2 November 2026.
What police, fire services and suppliers should do
HMICFRS recommends prioritising cybersecurity investment, modernising legacy ICT, strengthening third-party management and establishing baseline standards across forces and services. Action should concentrate first on weaknesses that could interrupt critical operations or expose sensitive information.
Organisations responding to the police cyber attack threat should review:
- Which legacy systems support essential services and whether they can still receive security updates.
- Whether multi-factor authentication covers privileged, remote and supplier access.
- How quickly accounts and permissions are changed when staff or contractors move roles or leave.
- Which suppliers store sensitive data or operate systems on the organisation’s behalf.
- Whether backups are isolated, complete and proven through realistic restoration tests.
Suppliers to blue-light services should also expect closer scrutiny of access controls, data handling, incident reporting and recovery capabilities. Evidence that safeguards work in practice will be more valuable than policies alone.
The report does not identify a universal technical fix because the weaknesses vary between organisations. Its central message is that resilience requires coordinated work across technology, people, suppliers and recovery planning, before another successful attack tests those arrangements.
Originally reported by The Independent.
