Dyfed-Powys Police is investigating a cyberattack that may have exposed information relating to more than 2,400 of its officers and staff, officials confirmed on Monday. The force, which covers the largest geographical area in England and Wales—spanning 4,188 square miles across four counties—detected the breach on September 14. While non-emergency systems experienced disruption, there was no impact on emergency services, such as 999 and 101 calls.
Authorities have indicated the incident is likely the first successful cyberattack directly targeting a British police force. According to a force spokesperson, there is currently no evidence that any personal data belonging to members of the public has been accessed or compromised. However, investigations continue to determine whether information related to police personnel was affected. Specialist cyber-security teams remain involved, and precautionary measures have been implemented to secure systems while the probe is underway.
The attack prompted a response from the organised crime unit for Southern Wales, which has joined the investigation. There has been no suggestion of hostile state involvement in the incident. The force serves a population of more than 500,000 and reported that it has remained fully operational throughout the disruption.
Local political figures have called for greater transparency regarding the extent of the breach. Paul Marr, a Reform UK Senedd member, emphasized the need for full disclosure to assure both frontline staff and the communities they serve that personal information is adequately protected. Marr highlighted the importance of strong cybersecurity and robust data protection measures as fundamental to safeguarding emergency services.
Previous cyber incidents involving UK law enforcement have occurred indirectly, such as in 2023 when hackers accessed information linked to Greater Manchester Police and the Metropolitan Police through attacks on third-party companies producing identification cards. The Police Federation of England and Wales has also experienced attempts to target its data systems. However, officials note that this Dyfed-Powys breach represents the first known direct attack on a police force itself.
The Information Commissioner’s Office (ICO) confirmed receipt of a breach report from Dyfed-Powys Police and said it is currently assessing the details as part of its oversight responsibilities.
Dyfed-Powys Police continues to monitor and investigate the incident closely, providing updates and support to its staff while maintaining full operational readiness to respond to emergencies across the region.