decrypted · 27 october 2026 · vulnerabilities and patching · supply chain · uk policy and law

Police data keeps leaking from suppliers, and the inspectors say contracts are the gap

Police forces rarely lose data from their own systems. According to a report published on Tuesday by His Majesty's Inspectorate of Constabulary and Fire & Rescue Services, whenever police information has been stolen since 2021, it was taken from the companies holding it. The inspectors' verdict is that policing and fire services are not fully prepared for a growing threat, and the supplier contract is where the gap is widest.

The cash-in-transit problem

Picture a bank with an excellent vault and a cash-in-transit contractor nobody has checked. The inspectors reviewed attacks between 2021 and 2025 and found that in every case the compromised systems belonged to outside companies holding police information, not to the police. The Record, reporting on the document, said most police supplier contracts had no ongoing cyber security assurance, some staff could not say whether suppliers had to report incidents promptly, and several in-house teams could not routinely see suppliers' system logs. The report names no suppliers, though The Record pointed to public cases such as a 2023 ransomware attack on an identity card maker that exposed Metropolitan Police staff details.

The wider picture

The Police Digital Service recorded 252 cyber security incidents and 796 near misses in policing between January and March 2026. Inspectors visited three police forces and three fire and rescue services between January and May. Leaders named legacy systems as their biggest strategic risk, and inspectors found weak password practices, patchy use of MFA (multi-factor authentication, a second check on top of the password) and some leavers' accounts left active. Some senior leaders said cyber security was not part of their day-to-day operational decisions. Police spent £1 billion of more than £16 billion on IT in 2024/25, and inspectors concluded that priorities were as much the barrier as cost.

What the inspectors want

There are 13 recommendations. Every police force in England and Wales is to reach level 3.0 on the national police cyber assessment, scored from 1.0 to 5.0, by September 2028; the current minimum is 2.0. ITPro reports that they also cover procurement and contract management of third-party IT suppliers. The inspectorate plans a reinspection. As Michelle Skeer put it, "A major cyberattack is not a hypothetical scenario."

The Secure by Design lesson

My view: supplier security is decided at procurement, long before any attacker turns up. A contract that fixes a notification deadline, gives you sight of logs, sets a security standard and lets you audit costs a solicitor's afternoon, not new technology. The cheaper control still is to hand over less. If a card printer needs a name and a photo, it does not need a rank, a force and a home address. Any UK organisation can borrow this: list the suppliers holding your data, ask each who tells you first when they are breached, and note how many cannot answer. Could your board name every one today?

Also this week

Apple widens a targeted-attack fix. Apple's patch for CVE-2026-86950, an out-of-bounds write in CoreGraphics, first shipped on 28 September in iOS 26.7.1 and iPadOS 26.7.1, with macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Apple said it may have been exploited in an "extremely sophisticated attack against specific targeted individuals" on iOS versions before iOS 27, and BleepingComputer reports the fix has now been extended to older iPhones and iPads. Meta Product Security found it. Most staff are not the target, but the few who might be, such as executives and policy teams, should be on a managed update path. A patch for new devices is not a patch for yours, so check the model, not the headline. Older iPhones are exactly what lingers in expense claims and personal-device schemes, so check any bring-your-own-device policy too. The design lesson is dull: devices that stop receiving updates become liabilities, so put hardware lifetimes in your asset register and retire what cannot be patched.

Texas sues OpenAI over ChatGPT safety. The state's attorney general filed suit on 23 October in Collin County, alleging OpenAI and its chief executive deceived users about safety. It seeks an injunction that would block minors from ChatGPT and require a court-appointed evaluator to approve new models. These are allegations, not findings, and OpenAI had not commented when the suit was reported. Pre-approval of models by an outside evaluator would be an unusually blunt remedy, and courts may narrow it. Whatever the outcome, the case shows how quickly consumer protection law is being turned on AI products. For UK firms using AI tools, the useful point is that regulators are treating safety claims as something that must be proved, not marketed. Ask your own vendors what evidence sits behind theirs.

Sources

If you want a second pair of eyes on your supplier contracts, get in touch.