Digital ID/Met Police Data Breach

A data breach at the Metropolitan Police could put thousands of police officers at risk.

On this page:

Case overview:

The Digital ID/Met Police Data Breach

In August 2023, the Metropolitan Police (the Met) experienced a data breach after a cyber security incident. The breach happened after an unauthorised party gained access to the systems of one of the force’s suppliers.

The security failure involved Digital ID, a company which makes warrant cards and identification badges. Digital identity (ID) refers to a digital representation of a person online and in physical interactions. Digital identity systems can offer efficiency, fraud reduction and privacy protection, but when they are exposed, especially in situations like this, it’s a serious situation.

Other forces may also have been affected. The breach has raised concerns for the Metropolitan Police staff association, which commented that the breach will cause concern and anger for many.

What you need to know

The following data and personal details may have been accessed in the Metropolitan Police data breach:

  • Names
  • Ranks and sensitive roles
  • Photos
  • Vetting Levels
  • Pay Numbers
  • Warrant Numbers
  • Pass Numbers

We believe that some officers have also had their geolocation data breached. The breach has the potential to cause huge damage if the compromised information finds itself in the wrong hands.

In total, according to one senior officer, over 20,000 details – including police officers’ names and photos – are “potentially at risk”.

A digital identity data breach can lead to identity theft, financial fraud and reputation damage. Financial loss can result from direct fraud from a digital id breach.

At KP Law, we have seen victims of similar data breaches become the target of cybercriminals, with instances of phishing, fraud, and identity theft.

KP Law specialises in complex, multi-claimant litigation. We investigate the underlying circumstances of each case, assess the available evidence and work with leading legal and technical experts where appropriate.

For data breach claims, this can include examining:

  • What information was accessed or compromised
  • How the breach occurred
  • The security measures in place before the incident
  • Whether applicable data protection obligations were complied with
  • The impact of the breach on affected individuals
  • The evidence required to establish liability and loss

Where appropriate, we coordinate claims collectively so that common legal and factual issues can be considered efficiently, while ensuring that individual circumstances are taken into account.

Thousands of individuals may have been affected where personal information held through their Met Police account was accessed without authorisation.

If you received a breach notification or you believe you were affected by the Met Police data breach, KP Law can provide further information about the investigation and the potential claim.

Exposed personal information from data breach incidents increases the risk of identity theft and phishing emails and scams.

Under GDPR, companies that gather or hold personal data have a responsibility to their customers to protect that information from unauthorised third parties. Group litigation can ensure consumers are adequately compensated for the damages caused, and that corporates should be held accountable for data privacy breaches.

What our data breach lawyers say:

“Data breach claims play an important role in holding organisations accountable when personal information is not adequately protected. Our team combines data protection expertise with experience of complex group actions to investigate breaches and pursue appropriate remedies.”

Kingsley Hayes | Partner & Head of Data & Privacy Litigation

Digital ID/ Data Breach Timeline
27 Aug 2023
27 Aug 2023
Reports emerged that the Metropolitan Police was investigating a possible data breach.
14 Sep 2023
14 Sep 2023
Greater Manchester Police released a statement confirming its involvement in the data breach. (Our action is only for the Metropolitan Police)

Why choose KP Law to represent you in this data breach?

At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.

FAQs for the Digital ID/Met Police data breach

The security failure involves the IT systems of Digital ID in Stockport, a company which makes warrant cards and identification badges. The company was targeted by cybercriminals in a ransomware attack.

The names, ranks, photos, vetting levels, warrant numbers, pass numbers and pay numbers for officers could have been accessed. 

At this time, there is no evidence that financial data or personal addresses have been accessed. However, some of the photos do have geo-location metadata data associated with them. This has the potential to cause incalculable damage.

UK Digital ID is used in certain cases right now – such as in the police service – mostly in the private sector. Suggestions have been made about a Digital ID becoming mandatory for all – discussed now by successive governments. But 63% of the British public do not trust the government too keep their data secure. So much so, over 95,000 people have signed a petition for the government to end plans for a mandatory digital ID.

Privacy groups have talked about risks associated with digital identity systems, data breaches and mass surveillance being just two. A mandatory digital ID system could potentially create a centralised database that could become a key target for hackers. Many call it a honeypot for hackers, putting the privacy and safety of millions at risk.

Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.

If you live in England or Wales and you are involved in this breach, you may be able to join our no-win, no-fee compensation claim. There are no costs to register and no obligation to proceed.

A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions

If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.

Latest news: Digital ID

What our clients say:

“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon

“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat

“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would choose them in any future action.” – Owen

Helpful guides

Getting justice for data hacking violations

By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.

READ THE GUIDE

Data breach support & faqs

At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.

READ THE GUIDE