Dyfed-Powys Police cyberattack

On 25 September 2026, Dyfed-Powys Police, the police force for south-west and mid Wales, confirmed that it had been the victim of a cyber incident first identified on Monday 14 September 2026. The incident disrupted some non-emergency systems, and online and email contact with the force was temporarily unavailable before being restored.

The force said 999 and 101 telephone services were not affected and that there was no evidence that members of the public had their personal data accessed. However, it acknowledged that information relating to police staff may have been accessed or compromised, without specifying what data was involved.

Response

The investigation is being led by Tarian, the regional cybercrime unit serving police forces in Wales, supported by cybersecurity specialists, and the incident was reported to the Information Commissioner's Office (ICO). The force did not say who was behind the attack or whether ransomware was involved.

Why it matters

Police staff data is sensitive in a way most employee data is not: exposure of officers' identities or home details can create safety risks and opportunities for intimidation. The roughly eleven-day gap between detection and public confirmation also left staff waiting to learn whether their data had been affected.