PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web
PNLD confirmed a breach where names, organizations, and work email addresses of UK police officers, criminal justice professionals, and government partners were published on the dark web The likely attack vector involves a misconfigured Microsoft Power Pages portal with Anonymous Users granted access to Dataverse tables, combined with an enabled Web API or legacy OData feed No evidence of compromised passwords, credentials, ransomware, malware, or software vulnerability exploitation was found in
Analysis
TL;DR
- PNLD confirmed a breach where names, organizations, and work email addresses of UK police officers, criminal justice professionals, and government partners were published on the dark web
- The likely attack vector involves a misconfigured Microsoft Power Pages portal with Anonymous Users granted access to Dataverse tables, combined with an enabled Web API or legacy OData feed
- No evidence of compromised passwords, credentials, ransomware, malware, or software vulnerability exploitation was found in the campaign material
- VenariX's analysis of ExfilSquad's claimed victims shows Dataverse-consistent data structures across 11 of 15 cases, with Houston confirming unauthenticated public portal access
- Microsoft provides a tenant-level governance control that can block unauthenticated Dataverse reads while allowing public form submissions, but PNLD has not disclosed exact access routes or victim counts
Why It Matters
This breach highlights the growing risk of cloud platform misconfigurations exposing sensitive government and law enforcement data, particularly when low-code platforms like Microsoft Power Pages are deployed without proper access controls. The incident serves as a cautionary tale for organizations relying on third-party SaaS platforms that handle sensitive data, demonstrating how seemingly minor permission settings can lead to large-scale data exposure.
Technical Details
- PNLD uses Microsoft Power Platform technology and hosts assets on Microsoft's content.powerapps.com domain; the breach exposed names, organizations, and work email addresses of approximately 108,429 registered users across all 43 Home Office police forces
- VenariX identified a campaign-level attack pattern involving public Power Pages sites with broad Anonymous Users access to Dataverse tables, requiring an enabled Power Pages Web API or legacy OData feed for data exfiltration
- Microsoft's documentation confirms that granting Anonymous Users role access to a table makes data visible to any site visitor, and the /_api interface follows table permissions attached to each web role
- The breach was identified on July 26, 2026, with ExfilSquad listing PNLD on their leak site the same day, though PNLD has not attributed the incident to the group
- Microsoft offers a tenant-level governance control that blocks unauthenticated users from reading Dataverse data while still permitting public form submissions, which could have prevented this type of exposure
Industry Insight
Organizations using Microsoft Power Platform should immediately audit Anonymous Users table permissions, Web API settings, and legacy OData feeds, then validate access from unauthenticated browser sessions to identify similar misconfigurations before exploitation. The incident underscores the importance of implementing tenant-level governance controls and zero-trust principles for any public-facing low-code applications handling sensitive data, particularly in government and law enforcement sectors. Security teams should also consider that data exposure through misconfigured APIs can enable sophisticated phishing campaigns using real named contacts, making rapid breach notification and user awareness critical components of incident response.
Disclaimer: The above content is generated by AI and is for reference only.