UK police and fire services face serious cyber attack risks as watchdog exposes security gaps

Police forces and fire and rescue services in the UK have been warned to urgently strengthen their cybersecurity after inspectors found outdated computer systems, inadequate safeguards and weaknesses in their ability to recover from attacks that could put public safety at risk.

A report published on Tuesday (October 27) by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) found that many organisations remain poorly prepared for increasingly sophisticated cyber threats, despite gradual improvements in their security arrangements.

The watchdog warned that successful cyberattacks had already disrupted police and emergency services, exposed weaknesses in their systems and imposed substantial recovery costs.

“The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix,” said Michelle Skeer, His Majesty’s Inspector of Constabulary and Fire & Rescue Services.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyberattacks.”

The inspection, conducted between January and May 2026, examined three police forces in England and Wales and three fire and rescue services in England. Inspectors also reviewed more than 260 documents, gathered over 1,250 pieces of evidence and consulted cybersecurity specialists and government organisations.

Outdated technology remains the biggest cybersecurity threat

The report identified ageing information and communications technology (ICT) systems as one of the most serious weaknesses affecting both emergency services.

Every organisation visited by inspectors depended on legacy technology to some extent, while senior leaders identified outdated systems as their highest strategic cybersecurity risk.

“Many police forces and fire and rescue services need to update their ICT systems to improve resilience,” the report said.

“Leaders we spoke to in both sectors identified these ‘legacy systems’ as their highest strategic risk for cybersecurity. Modernising ICT across both sectors must become a priority.”

Inspectors also found inadequate password management, insufficient use of multi-factor authentication and poor controls over access to computer systems when employees joined, changed roles or left their organisations.

“Some forces and services simply aren’t doing enough to prevent human error from increasing the risk of cyberattacks,” the report stated.

The Police Digital Service recorded 252 cybersecurity incidents and 796 near misses between January and March 2026. These included malware attacks, attempted unauthorised access to police systems and accidental disclosures of information.

The report also warned that police and fire services face an increasingly hostile cyber environment involving organised criminal groups and hostile states.

Cybersecurity spending and leadership criticized

Inspectors found that insufficient funding and competing operational priorities had delayed improvements to cybersecurity.

In the 2024–25 financial year, police forces spent more than £16 billion, including £1 billion on ICT, representing 6.4% of total expenditure.

Fire and rescue services spent £2.76 billion during the same period, but only £24 million, or 0.88%, went towards ICT.

The inspectorate said these figures demonstrated that the funding problem was partly a matter of organisational priorities.

Several senior police and fire leaders acknowledged that cybersecurity was not routinely considered when making operational decisions.

“Underpinning all these problems is a leadership issue,” the report said. “Several senior police and fire leaders we interviewed told us that they didn’t consider cybersecurity to be part of daily operational decision-making.”

The report added that many senior leaders had operational rather than technical backgrounds and frequently depended on more junior cybersecurity specialists to explain emerging threats and protective measures.

Skeer called for a change in approach. “Cybersecurity should be viewed as a core organisational priority and not solely a technical risk. Leaders need to prioritise and invest in their cybersecurity arrangements to improve their organisation’s ability to prevent, detect, respond to and recover from attacks.”

Third-party suppliers expose sensitive police information

The inspectorate also raised concerns about the increasing reliance on external technology suppliers to manage computer systems and store confidential information.

Police data held by contractors can include details of victims, safeguarding cases, intelligence and ongoing criminal investigations.

Inspectors found that some organisations accepted cybersecurity certificates from suppliers without checking which systems were covered. Others failed to conduct annual security reviews, scrutinise high-risk contractors or maintain complete records of companies handling sensitive information.

The report found that forces and services often had limited visibility of data and systems managed by external providers, making it harder to identify potential breaches.

It recommended stronger procurement procedures, improved contract management and mandatory cybersecurity standards for new and renewed supplier agreements.

Fire services lack national cyber defence capability

The report identified a significant difference between policing and fire and rescue services in their ability to detect and respond to cyberattacks.

Police forces can access specialist support through the Police Digital Service’s National Management Centre, which monitors threats and coordinates responses to major incidents.

Fire and rescue services have no equivalent national capability.

According to the National Fire Chiefs Council, only seven English fire and rescue services had their own security operations centres in 2025.

Inspectors found that some emergency services lacked dedicated cybersecurity monitoring outside normal working hours. Others had insufficiently tested incident response procedures and unsatisfactory arrangements for backing up and restoring critical computer systems.

Although every organisation inspected had business continuity and incident response plans, some had not adequately tested their ability to recover from a serious cyberattack.

The watchdog recommended developing continuous monitoring capabilities across fire and rescue services and establishing stronger national arrangements for responding to cyber incidents.

Watchdog sets deadlines for cybersecurity improvements

HMICFRS issued 13 recommendations covering security standards, leadership, supplier management, monitoring and emergency preparedness.

Chief constables in England and Wales have been told to ensure their forces achieve and maintain a cybersecurity maturity level of at least 3.0 under the Security Assessment for Policing framework by September 2028.

Chief fire officers in England have been given until November 2027 to achieve baseline standards under the National Cyber Security Centre’s Cyber Assessment Framework.

Other recommendations call for improved cybersecurity training for senior leaders, stronger external assessments of fire service security arrangements and better coordination between government departments and emergency services.

The inspectorate also warned that existing government cybersecurity initiatives had not adequately addressed the specific risks facing policing and fire and rescue services.

Skeer said the government’s proposed police reforms and local government reorganisation presented opportunities to strengthen security.

“These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

The inspectorate said it would carry out a further inspection to assess progress against its recommendations.