Dyfed-Powys Police confirms cyberattack, staff data may be affected

Dyfed-Powys Police has confirmed it was hit by a cyberattack that knocked some of its systems offline. The Welsh police force said it identified the incident on September 14 and that it caused disruption to some non-emergency systems. Investigators are now trying to establish whether the intruders got their hands on staff data during the break-in.

What the force has said

Dyfed-Powys Police said an investigation has been under way since the incident was discovered. Cybersecurity specialists were brought in, and "precautionary measures" were applied to its systems while teams worked to restore services safely.

"At this stage, our investigation has found no evidence that members of the public's personal data has been accessed or compromised as a result of this incident," the force said in a statement.

"We are, however, continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required."

What remains unclear

There is no indication yet of who was behind the attack, how they got in, or whether ransomware was involved. There is also an unresolved question over what the intruders may have managed to access. Beyond the date the incident was identified, the force has not published a timeline.

Dyfed-Powys Police said it has notified the Information Commissioner's Office, the UK data watchdog, although it did not say when the regulator was informed.

Who is investigating

The investigation is being managed by Tarian, the regional organised crime unit covering the three southern Welsh police force areas, through its regional cybercrime unit.

The Register asked Dyfed-Powys Police for more detail about the attack but did not immediately receive a response.

Why it matters

"We understand the potential concern this may cause and want to reassure the public that we have and will continue to take all necessary steps to protect our information and maintain the security of our systems," Dyfed-Powys Police said.

For now, the force says the public's data appears to have escaped the intruders. Whether the same can be said for its staff remains under investigation, and that will determine what affected employees are told and which regulatory steps follow.