Up to 300 attempts made to access information from PSNI data breach

Up to 300 attempts were made to access information disclosed in the Police Service of Northern Ireland (PSNI) data breach before it was shut down, a police chief has told the High Court.

Chris Todd, a former assistant chief constable in the force who handled the fallout from the leak, set out how officers' service numbers were changed and some covert teams relocated as part of a "mammoth" effort to degrade the value of the material.

Mr Todd, who is now in charge of Humberside Police in England, was giving evidence in a major legal action over the leak in August 2023.

Thousands of police officers and civilian employees are suing the PSNI following the unprecedented data breach.

Their personal details were accidentally published on a website in response to a Freedom of Information (FoI) request.

Names, ranks and roles of all PSNI officers and staff were all disclosed.

Days later it was confirmed that dissident republicans had accessed the information.

Damages are being sought for negligence and violating their right to privacy.

Despite accepting liability, funding is not currently available for the PSNI to settle actions at an estimated total cost of £120m.

Mr Todd told how the leaked details, including surnames and initial, gender and service number, was mistakenly released under a hidden tab on the spreadsheet.

"It was one page with 32 columns relating to just under 9,500," he said.

At the time, Mr Todd was appointed gold commander in what became known as Operation Sanukite, the PSNI's response to the breach.

Within two hours of the material appearing online, Mr Todd was alerted and issued immediate orders to have it taken down.

Less than 30 minutes later, the list was hidden from public view before being totally removed from the website.

"We identified approximately 300 attempts had been made to access the data, relating to 200 individuals," he told the court.

Although many of those related to PSNI employees who had learned of the breach, investigations established that the details had also fallen into the hands of organised criminals and terrorists.

Mr Todd stressed that some of the information subsequently posted publicly about officers' names was not accurate.

Questioned by Nicolas Hanna KC, for the PSNI, he went through a series of measures the force took to offer support and counselling to staff impacted by what happened.

External occupational health services were also made available, along with payments of up to £500 for increased home security.

The court heard that a prioritisation grading system was devised to assess the mental health and risks against some officers.

"A handful of those people required additional security measures, I couldn't give specifics but it would be between five and 10," Mr Todd said.

He confirmed that he was not aware of any targeted attack on PSNI officers since the data breach.

Asked what steps were taken to degrade the information following the leak, he explained the most effective mitigation involved altering the locations where some officers were deployed and bringing in new service numbers.

"It was a mammoth task," Mr Todd said.

Further measures related to changes made to banking arrangements and digital footprints left by staff members through other legitimate agencies.

Cross-examined by Gavin Millar KC, for some of the officers suing over the breach, Mr Todd confirmed that no one spotted the hidden tab in the checking process before the Freedom of Information material was released.

It was put to the police chief that some "bad actors" may be able to match up the disclosed details in order to make identifications.

Mr Millar argued that the perception of risk was the same for everyone who featured on the list.

"It's every case on its merits, some people live more publicly than others… and some go to great extent to conceal their membership of the PSNI," Mr Todd replied.

The case continues.