The **Police National Legal Database (PNLD)**, a service providing legal information to UK police forces and criminal justice organizations, has disclosed a data breach that resulted in the publication of sensitive contact information on the dark web. The incident, identified on July 26, exposed names, organizations, and work email addresses belonging to police officers, police staff, criminal justice professionals, government partners, and customers. Additionally, some names and email addresses of individuals who submitted questions through 'Ask the Police' were also compromised. ### Potential Phishing Risk This exposure creates a heightened risk for targeted phishing messages, as attackers could leverage the leaked information to craft more convincing communications, as highlighted by **UK government guidance**. **PNLD** has stated there is "no evidence to suggest that passwords or other security credentials have been compromised." The organization has clarified that it is distinct from the **Police National Computer** or **Police National Database** and does not hold confidential information about victims, witnesses, or offenders. ### Response and Investigation Following the discovery, **PNLD** contacted all affected organizations and 'Ask the Police' users, providing further information and guidance. The **Information Commissioner's Office (ICO)** has been notified, and **PNLD** is collaborating with the **National Crime Agency (NCA)** and specialist cybersecurity firms. As of August 3, 2026, **PNLD** has not publicly disclosed the total number of individuals affected, the duration of the intrusion, or the precise volume of data exfiltrated.  ### The Microsoft Power Platform Connection **PNLD**'s 2023-24 annual summary indicates the database utilizes **Microsoft Power Platform** technology. This connection was further corroborated by **The Hacker News** on August 3, 2026, noting that the breach-notice page referenced assets hosted on **Microsoft**'s `content.powerapps.com` domain. Cybersecurity firm **VenariX** reviewed samples associated with 11 of **ExfilSquad**'s 15 claimed victims and observed **Dataverse**-consistent structures across all. In one instance, **VenariX** confirmed that a public portal returned records without authentication, consistent with data published by the group. ### Hypothesis: Misconfigured Power Pages **VenariX** assessed a likely campaign-level attack path involving public **Power Pages** sites with broad 'Anonymous Users' access to **Dataverse** tables, coupled with an enabled **Power Pages Web API** or legacy **OData** feed. **Microsoft**'s documentation explicitly states that granting the 'Anonymous Users' role access to a table makes its data visible to anyone visiting the site. Their **Web API** documentation also confirms that the `/_api` interface adheres to table permissions assigned to each web role. While this points to a potential vulnerability, **VenariX** cautions that the evidence "does not yet confirm that every organization was affected through an exposed Power Apps portal or the same configuration issue." Neither **PNLD**'s notice nor **VenariX**'s report has identified a **PNLD**-specific endpoint, permission setting, API route, or supporting log, leaving the Power Pages link as a hypothesis to be tested. ### Recommendations for Power Pages Operators **Microsoft** offers a tenant-level governance control to block unauthenticated users from reading **Dataverse** data while still allowing public form submissions. **VenariX** recommends that **Power Pages** operators review 'Anonymous Users' table permissions, **Web API** settings, and legacy **OData** feeds, validating access from an unauthenticated browser session. These measures are designed to address the configuration pattern identified by **VenariX**, though they are not a confirmed root cause for the **PNLD** breach. **ExfilSquad** listed **PNLD** on its leak site on July 26, but **PNLD** has not officially attributed the incident to the group. **VenariX** found no evidence of ransomware deployment, malware use, lateral movement, or exploitation of a software vulnerability in the campaign material it examined.