Greater Manchester Police suffered a significant data breach following a cyber security incident at one of its vendors that makes digital identity cards and lanyards for the police force

Stockport-based ID card and lanyards manufacturer Digital ID reportedly suffered a significant cyber security incident that compromised the sensitive personal information of more than 12,500 Greater Manchester police (GMP) officers and staff.

ACC Colin McFarlane of Greater Manchester Police (GMP) confirmed that the third-party vendor suffered a ransomware attack that led to the data breach at the police force.

“We are aware of a ransomware attack affecting a third-party supplier of various UK organisations, including GMP, which holds some information on those employed by GMP,” McFarlane said.

According to The Guardian, the leaked information includes names, ranks, photos and serial numbers of police officers and staff. This also means that the identity of those working in undercover roles can be exposed.

McFarlane said that the force has so far found no evidence of financial information being compromised in the data breach.

“We understand how concerning this is for our employees so, as we work to understand any impact on GMP, we have contacted the Information Commissioners Office and are doing everything we can to ensure employees are kept informed, their questions are answered, and they feel supported.

“This is being treated extremely seriously, with a nationally-led criminal investigation into the attack,” he said.

Several officers working with the Greater Manchester Police expressed their concerns following the data leak. An officer, who spoke anonymously to the BBC, said that while most of the identities of officers are publicly available, the major concern is of those who are working undercover.

The agency is working with the National Cyber Security Centre and the National Crime Agency to investigate the cyber security incident. The Information Commissioner’s Office has also been notified about the incident.

In a statement shared with the media, Head of Cyber Investigations at the Information Commissioner’s Office, Elizabeth Baxter said, “Police officers and staff expect their information to be kept secure, and are right to be concerned when that doesn’t happen. This incident has been reported to us, and we’ll now be looking into what happened, and asking questions on behalf of anyone affected.

“Organisations must look after employee information, particularly in sectors where the impact of a data breach could be greater. The ICO works to support organisations to get this right so people can feel confident that their information is secure,” Baxter added.

Commenting on the news, Luke Dixon, partner and expert data protection lawyer at Freeths, said, “Organisations are increasingly aware of the threat hackers pose to their systems. This shows that they can be exposed to hacks on their suppliers’ systems as well. Prevention is better than cure, but be ready for any breaches that cannot be prevented.

Dixon said organisations need to ask themselves and assess whether a supplier can protect the data it has been given and whether both organisations are capable of effectively responding to a data breach if it occurs.

“If you cannot answer these questions, do two things. First, ensure your supplier has robust measures in place to protect the data. Second, require it to report incidents to you without delay and in good detail – this is crucial to your breach response,” he added. https://www.teiss.co.uk