His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a cyber inspection of police forces and fire services in England and Wales on Oct 27. It found legacy systems everywhere (which leaders called their top cyber risk), weak backup and restore arrangements, gaps in monitoring coverage, and senior leaders who don't treat cybersecurity as part of daily operational decisions. "A major cyberattack is not a hypothetical scenario," said HM Inspector Michelle Skeer.

According to The Record's reading of the report, the Police Digital Service told inspectors about multiple attacks since 2021 on third-party ICT suppliers holding police data, and recorded 252 cyber incidents and 796 near misses in policing in January-March 2026. Most supplier contracts had no ongoing security assurance. Operational details were removed from the public version. HMICFRS makes 13 recommendations, including baseline standards, external validation of self-assessments and better supplier procurement and contract management.