More than 20,000 details including names and photos ‘at risk’ in data breach

Photo: Greater Manchester Police

GMP Chief Resource Officer Lee Rawlinson. Greater Manchester police, fire and crime panel. September 18, 2023.

The details of more than 20,000 people – including names and photos of police officers – are ‘potentially at risk’ following a data breach affecting GMP.

The data breach at a Stockport-based company contracted by the force is now under investigation.

Last week, an internal email to GMP staff revealed the name of the contractor where the breach happened as Digital ID. The data breach has affected other organisations across the UK too, including the Metropolitan Police in London.

Speaking at a public meeting yesterday (18 September), a senior GMP officer said ‘several’ police forces and ‘many’ government departments are also involved. Chief resource officer Lee Rawlinson told the Greater Manchester police, fire and crime panel that the data breach is being treated as a ‘very serious event’.

He said: “This was not a breach of Greater Manchester Police’s data. This was a third party’s data breach which we were quite rightly in contract with and there were data protection agreements in place around some of that. So that is what’s currently under investigation.

“It wasn’t solely of Greater Manchester Police either. There are several police forces up and down the country as well as many other government departments that were involved in this. So we are part of a wider national picture around some of this at the moment.

“We have informed the Information Commissioner as duty bound to do so to make sure the Information Commissioner is sighted on all that information. I think around 20,000-plus details had been potentially at risk. I say potentially, because we’re still waiting for the company that has been breached to get as much detail of what actually has gone to us as that.

“The information that’s potentially gone is relatively low-risk i.e. it doesn’t have financial details or specific details, but obviously, it does pertain to some officers’ names and in some cases photo identification. So we’re treating it as a very serious event. The investigation is under way.

“At this stage we have notified all our staff, any specific risks have been identified and it’s part of the investigation as it evolves. If that risk evolves even further then of course we will update accordingly.”

The Local Democracy Reporting Service has asked GMP to clarify whether the ‘20,000-plus’ details referred to relate specifically to the force. GMP said it is not confirming the numbers affected at this stage as it is still notifying staff.

Some 12,000 police officers and civilian staff at the force were informed of the data breach last week. An internal email to GMP staff on 13 September revealed the name of the contractor where the breach happened as Digital ID.

The Stockport-based company has been contacted for comment. Last week, on 14 September, a Digital ID spokesperson told the Manchester Evening News: “Last month, we identified an IT security incident that affected the company’s systems. We quickly engaged specialist external cyber and forensic consultants to conduct an investigation into the impact of this incident and the data that may be involved; this investigation remains ongoing.”

Joseph Timan, Local Democracy Reporter