Dyfed-Powys Police restores online contact as it checks whether attackers reached staff data
Dyfed-Powys Police says a cyberattack identified on September 14 may have exposed staff data at a force of more than 2,000 officers and staff. Online and email contact is back in service while investigators establish whether the attackers reached any staff records.
The Watch · Security desk
What happened
- The attack disrupted only non-emergency systems, and the 999 and 101 telephone lines stayed up throughout.
- The force says it has found no evidence that personal data belonging to members of the public was accessed.
- Tarian, the regional organized crime unit for southern Wales, is leading the investigation with outside cybersecurity specialists.
- The Information Commissioner's Office has been notified of the incident while the investigation continues.
Why it matters
- Who has to decide decision Staff have to settle on their own precautions for now, because the force has committed to advising employees only 'if required'.
- What it limits constraint Other police forces and public bodies have no indicator from this incident to check their own networks against until an entry point is published.
- Who's exposed exposure Until the scope is set, any of the force's more than 2,000 officers and staff could be among those whose details were reached.
Next story · Leadership · 11h ago
Met staff used an unapproved Auror platform for about 18 months, ICO findsConfirmed2 publishers
The staff-data inquiry is the job still running. Investigators are examining whether information relating to police staff was exposed, and the force says the full impact of the incident has not yet been established [4][5]. It has not said which staff records are involved, how the attackers got in, or who they are [5][8].
The force's statement led with the outage. "We can confirm that the force has been subject to a cyber incident which was identified on Monday September 14, 2026. The incident caused disruption to some non-emergency systems," it said [10]. Precautionary measures are now in place across its systems. Specialist teams are monitoring those systems while they investigate and restore services [12]. "We understand the potential concern this may cause," a spokesperson told The Record [11].
Restoring contact channels and scoping a data exposure are measured differently. The first is finished when the public can email the force again. The second is finished when investigators can say what the intruders touched, and the force says it has not reached that point [5]. Until it does, the risk to staff cannot be rated. On the force's account, the risk to the public is low [3].
One detail in the reporting did not come from the force: The Record's note that no group had claimed responsibility when it published [9]. Every other detail comes from the force and its spokesperson [10][11]. On that evidence this is one incident at one force.
What to watch
- Dyfed-Powys Police naming the categories of staff data involved and issuing advice to employees.
- A claim of responsibility or a leak-site listing that names the force.
- The force or Tarian disclosing how the attackers got in.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Dyfed-Powys Police said the cyber incident was identified on Monday, September 14, 2026.
- [2]
The incident disrupted some non-emergency systems; emergency response was not affected, and the 999 and 101 telephone services continued to operate.
- [3]
The force said there is currently no evidence that members of the public had their personal data accessed or compromised.
- [4]
The investigation is examining whether information relating to police staff may have been accessed or compromised.
- [5]
The force has not provided details about what staff information may have been accessed or compromised, and the full impact of the incident has not yet been established.
- [6]
Dyfed-Powys Police said it is taking steps to protect staff information and will provide appropriate advice to employees if required.
- [7]
Tarian, the regional organized crime unit for southern Wales, is leading the investigation with support from cybersecurity specialists.
- [8]
The force has not disclosed how the attackers gained access to its systems or identified those responsible.
- [9]
No group had claimed responsibility as of The Record's publication.
- [10]
"We can confirm that the force has been subject to a cyber incident which was identified on Monday September 14, 2026. The incident caused disruption to some non-emergency systems,"
- [11]
"We understand the potential concern this may cause,"
- [12]
The force has implemented precautionary measures across its systems, and specialist teams are investigating and working to restore services safely while the force monitors its systems.
- [13]
Online and email contact services were unavailable for a period after the incident and have since been restored.
- [14]
The Information Commissioner's Office has been notified about the incident as the investigation continues.
- [15]
Dyfed-Powys Police covers southwest Wales and has more than 2,000 officers and staff.
Sources
2 independent publishers whose own reporting we read for this story.
- thecyberexpress.comCyberattack Disrupts Police Systems in Wales, Staff Data Under Investigation
1 article · September 27, 2026
- therecord.mediaCyberattack hits Welsh police force, may have affected staff data
1 article · September 25, 2026
Topics and entities
Topics
- UK data breach notification
- Public Sector Cyberattacks
Entities
- Dyfed-Powys Police
- Information Commissioner's Office