Greater Manchester Police officer data exposed in supplier ransomware attack

Greater Manchester Police confirmed on 14 September 2023 that personal details of its officers and staff had been taken in a ransomware attack on a third-party supplier that produced the force's identity badges and warrant cards. TechCrunch identified the supplier as Digital ID, a card manufacturer based in Stockport.

The stolen material related to warrant cards and staff identity badges. Reporting described names, photographs and identity or collar numbers among the information held by the supplier, and the force said financial information was not involved. Coverage differed on scale: BBC News reported that more than 20,000 details, including names and photographs, were potentially at risk, a figure TechCrunch cited and rendered as as many as 20,000 individuals. The force declined to confirm a number, and other outlets said the exact total was not known.

The National Crime Agency led a criminal investigation into the attack, which was assessed as the same incident behind a data breach disclosed by London's Metropolitan Police the previous month. Both forces used the same supplier.

Assistant Chief Constable Colin McFarlane said the force had contacted the Information Commissioner's Office and was doing everything it could to keep employees informed, adding that the matter was being treated extremely seriously. Digital ID engaged external cyber and forensic consultants. Security specialists quoted at the time suggested the intrusion was most likely opportunistic rather than a targeted attack on the police.