More UK cops' names and photos exposed in supplier breach

London's Metropolitan Police has said a third-party data breach exposed staff and officers' names, ranks, photos, vetting levels, and salary information. In a statement posted on the cops' website, the force said miscreants broke into a supplier's IT system, and used that unauthorized access to steal personnel information. The …

[Mike 137]

"Security measures have been taken by the MPS as a result of this report," the statement said

Always after the data breach. The only viable security is proactive security -- making your infrastructure the hardest possible nut to crack commensurate with the value/sensitivity of the information to be protected -- before it's been breached.

The big problems that prevent this are [1] the up front cost, which usually seems unnecessary because "nothing's happened yet", [2] the utter uselessness of current common practice in risk assessment, which typically causes assessment results to be meaningless, [3] a fundamental misapprehension that 'policies' automatically drive behaviours, [4] an almost complete lack of adequate training for staff at all levels, right up to the executive, who frequently get exempted from the (typically useless) so-called 'training' provided.

Until these deficiencies are fixed, there'll be no such thing as genuine infosec, so the adversary will usually win.

[alain williams]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

We have not yet been told "lessons will be learned", after which we will all be able to relax safe in the knowledge that it will never happen again -- not!

[Doctor Syntax]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

Lessons should be learned from mistakes but it's best if you can learn them from other people's mistakes.

[cyberdemon]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

No doubt someone will be "Laser Focused" on security from here on in.

Next politician to say that gets fed to the sharks

[elsergiovolador]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

What sharks done to you?

[Derezed]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

I think they cut the sharks in the last budget. Outsourced to Anchovies I believe…more cost effective

[John Brown (no body)]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

...with teeny, tiny lasers?

[Derezed]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

I believe there was no money left for lasers…it is said that they are both mutated and Ill tempered

[LybsterRoy]

Re: "Security measures have been taken by the MPS as a result of this report," the statement said

One of my favourite comments is:

You have to learn from other people's mistakes, you don't have time to make them all yourself.

[cantankerous swineherd]

nothing to hide, nothing to fear.

[Headley_Grange]

Since you don't post with your real name I wonder what you've got to hide.

[Nifty]

Thanks for your interesting post, Mr. Grange

[TheMaskedMan]

"nothing to hide, nothing to fear."

And yet they are fearful. I can understand why, and I sympathise to some extent. This sort of cockup just shouldn't happen, and it's obvious that some bobbies may be put at unreasonable risk, to say nothing of the possibilities for impersonating a police officer.

But perhaps now they will understand why many people are not too keen on police forces sucking up information like an overenthusiastic sponge. Many of US don't have anything to hide, either, but we are still rightfully afraid of what might be done with our personal data in the name of law enforcement. If they can't keep their own stuff secret, how can we expect them to keep our details confidential?

The potential for internal abuse / misuse together with external unlawful access, regardless of whether or not that is a consequence of incompetence, do not inspire confidence.

[ethindp]

Nothing to hide? Really? Do you tell your friends all your credit card numbers, identity information, passwords, etc? Yeah, I didn't think so. So much for nothing to hide....

[JT_3K]

You say that, but look at the lady stabbed by a member of the general public because "he thought she was employed by GCHQ". No worry about what she has or has not been part thereof, no comment about her role (could have been anything from senior to the onsite cleaner). There's lots to fear because "people" are muppets.

And believe me, I'm not passing comment on the effectiveness, engagement or activities of UK police in any capacity: positive or negative.

[elsergiovolador]

IR35

After IR35 changes British businesses lost access to skilled workers - they retired early or moved on.

The IT incidents will be piling on...

[IGotOut]

Re: IR35

So contractors never fucked up? New one on me.

[elsergiovolador]

Re: IR35

We didn't hear of as many incidents prior to the changes to legislation.

If contractor efs up, their business is in a pickle if they don't have adequate insurance, so they must be extra sure they don't ef up.

Now hiring a zero hour IT deemed employee worker doesn't come with such reassurances.

[Headley_Grange]

Re: IR35

"We didn't hear of as many incidents prior to the changes to legislation."

Maybe the reporting restrictions were less prescriptive or there are more bad actors out there than there used to be.

[elsergiovolador]

Re: IR35

Or maybe it was the legislation that made it more difficult to access competent workforce.

I think you are not aware how many projects were turned upside down in 2021 because of mass exodus of experts.

[Cav]

Re: IR35

Nonsense. Many places are still only just updating processes and infrastructure to use technology. Training hasn't kept up and more people doing more online leads to more errors. IR35 changes are irrelevant.

[LybsterRoy]

Re: IR35

and don't forget pure incompetence!

[elsergiovolador]

Re: IR35

These changes are entirely relevant.

Before the changes any expert in their field would have incorporated to receive fair compensation for their expertise and look to expand their business. They could fund training and upskill in areas where there was a market need and fill in the gaps their clients had in their projects.

IR35 has closed that path. People no longer have an incentive to upskill and software development has become very much a dead end, if you are not coming from a wealthy background.

This has been done to stop people leaving from big consultancies or their jobs and starting competing business.

In the past, if business had to adapt a new technology, their workers were not familiar with, but was necessary for growth, they would have hired an independent business to set everything up and train their workers and offer support. This is now only available from big consultancies who are exempt from IR35, but their quality is very poor.

[sitta_europea]

If they're that careless with information about their own staff, what must it be like in the complaints department?

[elsergiovolador]

Maybe complaints are stored securely in /dev/null ?

[heyrick]

The rozzers have a complaints department? Would that be the dark room at the end of a corridor lined with snarling men holding their truncheons in a menacing manner?

[Red Or Zed]

Of course not, that's completely ridiculous!

It'll be just down these stairs.

Mind you don't trip...

[Derezed]

And if you DO trip, don’t get accidentally rolled up in the loose carpet and hit those loose rubber hoses on the way down

[Anonymous Coward]

In a statement posted on the cops' website, the force said miscreants broke into a supplier's IT system, and used that unauthorized access to steal personnel information.

Tell me that you entrusted the job to Capita without telling me that you entrusted the job to Capita

[Anonymous Coward]

I can only hope

that the locks on prison cells are more secure than the locks on the data

[Anonymous Coward]

Oh, Suealla

Welcome to Brexit Britain, a strange mirror world, where even the surveillance state program is ass backwards.

[Cav]

Re: Oh, Suealla

You had to force a Brexit moan into a subject to which it is entirely irrelevant.

[Anonymous Coward]

What a right cop up!

Allo, Allo, Allo.

Goodbye, goodbye, goodbye…

[Anonymous Coward]

Nothing to fear, Nothing to hide....

(1) Wayne Couzens

(2) David Carrick

(3) .....and the beat goes on..................

[Christoph]

"There is also a huge concern that photographs of police on undercover units, surveillance or in sensitive areas like counter-terrorism could fall into the wrong hands,"

The terrifying possibility that women in entirely legal protest groups might find out that their 'boyfriend' is an undercover Met officer spying on them and all their friends and using them as a useful tool.

[Anonymous Coward]

"...exposed staff and officers' names... and salary information"

HR will be apoplectic - employees are not allowed to know their colleagues salaries.

HR policy on salaries is divide and conquer.

Every MPS employee now has a significant incentive to view that data.