Cyber attack on police force may have 'compromised' staff information
BBCA cyber attack on a police force in Wales may have resulted in staff information being "accessed or compromised".
Dyfed-Powys Police said the hack had caused disruption to some non-emergency systems but no personal data relating to members of the public was believed to have been accessed.
The force said the incident was identified on 14 September, and an investigation is under way.
The Information Commissioner's Office (ICO) has been notified, with a spokesperson saying: "We can confirm we have received a breach report from Dyfed-Powys Police and we are assessing the information provided."
Dyfed-Powys Police said it remained fully operational and its response to emergency incidents had not been affected.
It said online and email contact services were unavailable for a period following the attack, but these had now been restored and 999 and 101 service had not been affected.
The force said it was receiving support from cyber-security specialists and its systems had been subject to "precautionary measures" while specialist teams investigated the incident and worked to restore services safely.
A spokesperson said: "At this stage, our investigation has found no evidence that members of the public's personal data has been accessed or compromised as a result of this incident.
"We are, however, continuing to investigate whether any information relating to our staff may have been accessed or compromised, and are taking all appropriate steps to protect that information, and will provide appropriate advice to colleagues if required."
They added they "understood the potential concern this may cause" and wanted to "reassure the public that we have and will continue to take all necessary steps to protect our information and maintain the security of our systems".
The force said it would provide further updates when it was in a position to do so.
The ongoing investigation is being managed by Tarian, the Regional Organised Crime Unit (ROCU) for southern Wales, and force systems are being monitored.
The IOC spokesperson said anyone worried about their personal information can visit the ICO website for advice and support.
"We advise checking regularly for updates from the organisation impacted and following their advice if they confirm that an individual's personal information has been compromised," they added.
Dyfed-Powys Police and Crime Commissioner Dafydd Llywellyn said the attack was "serious", adding that "police information and the information that police systems hold is very sensitive data from the public's perspective".
"What's important to note in this case is that personal information from the public has not been breached, to my knowledge," he added.
"Some systems were closed down for a protective measure to ensure that no further information was breached in that way."
He added that the response from the force had been "very strong" and the "security weaknesses have been patched up".
The area served by Dyfed-Powys Police includes Carmarthenshire, Ceredigion, Pembrokeshire and Powys, and equates to more than 500,000 people - a number that rises significantly with tourists each year.
The force has 1,349 police officers, as well as 1,063 police staff, police community support officers (PCSO) and special constables, according to an information request in March 2026.
Dr Nisha Rawindaran, lecturer in Cyber Security and Forensics at the University of South Wales said: "Cyber attacks happen every day across public and private sectors but what we hear publicly is a fraction of the actual events because only a smaller number turn into something that has a wider impact and requires a coordinated response."
She added that with any cyber incident "the key is not just if information has been stolen, but whether systems have been disrupted, and how quickly organisations can recover from this".
