A report published on October 27 by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) highlights risks in digital supply chains. It says third-party suppliers holding police information were compromised on multiple occasions between 2021 and 2025.
Incidents at suppliers
According to the report, the incidents did not involve direct attacks on police ICT systems. Third-party supply chains holding police information were compromised. The public version does not disclose the number of incidents, the suppliers or forces involved, or whether information was stolen.
Those limits matter: the report identifies data being put at risk, not public proof that specific records were copied. Operational details considered unsuitable for publication were removed.
Supplier assurance that does not continue
Inspectors found that most agreements they reviewed did not include ongoing cybersecurity assurance. Assessments often relied on supplier self-reporting, with gaps in rapid incident notification and sharing logs needed for an investigation.
A check during procurement is not enough if practices, systems or subcontractors change over the life of a contract. The report calls for stronger contract management, security requirements and ongoing monitoring.
What organizations can check
Buyers can clarify notification duties, reporting timelines, access to logs and evidence of controls. They should also know which subcontractors process the information, how access is revoked and how incident response is exercised with the supplier.
The report recommends stronger governance and baseline standards. It does not claim that one contract check will eliminate risk, but emphasizes that data security also depends on the providers that host or handle it.
The connection to Soclyde
Credential governance is part of supplier management. Soclyde helps small teams keep unique passwords in local-first vaults, but does not assess a supplier's security or replace contractual assurance and monitoring. Our guide to team password sharing covers access management practices.
Key points
The HMICFRS report describes compromises of suppliers holding police information and gaps in ongoing oversight. Public details do not establish whether data was stolen. Improvement includes supplier assurance that continues throughout the contract.
