Police and fire services in England and Wales face serious cyber threats due to outdated systems and poor security practices, a new report has found.
Legacy Systems Are a Major Vulnerability
Most services still use IT systems from decades ago. These systems lack modern security features like encryption and real-time threat detection.
Senior leaders in both sectors see these legacy systems as their top cybersecurity risk. One inspector called them ‘fundamentally unprepared’ for today’s threats.
Outdated systems leave services open to attacks that could leak data or disrupt emergency operations.
Human Error and Poor Security Practices
Human mistakes are a key weakness. Many services skip onboarding new staff properly. This lets unauthorised people access systems early.
Offboarding is often ignored. Former staff may still have access after leaving.
Many services don’t use multi-factor authentication. A single password breach can give full access to sensitive data.
Simple or reused passwords increase the risk of breaches. These practices are common and poorly managed.
Third-Party Contractors Pose Risks
External IT contractors are often used. But some store sensitive data on their own systems.
If a contractor is breached, personal records or operational details could be exposed.
HMICFRS recommends strict monitoring of third-party access and clear data protection clauses in contracts.
Backup Systems Are Inadequate
Backup systems are vital after a cyberattack. But most services have ‘unsatisfactory’ backups.
These systems rarely get tested. Data is often stored in insecure locations or not updated.
Without reliable backups, services could face days or weeks of downtime. Emergency functions might be disrupted.
Leadership and Operational Priorities
Many senior leaders have operational backgrounds, not IT expertise.
Cybersecurity is often seen as secondary. Decisions focus on daily operations, not long-term digital safety.
Leaders rely on junior staff to explain risks. This delays action and weakens strategic planning.
Cyber threats are not included in budgets or daily decisions, despite growing risks.
Recommendations for Improvement
- All police forces and fire services should meet baseline cybersecurity standards. This includes regular audits and staff training.
- Third-party contractor management must improve. Clear accountability and data policies are needed.
- A national digital management centre should be set up for fire services. This mirrors the existing police structure.
Why This Matters
Cyber threats are not just possible—they have already happened.
Attacks have disrupted emergency services, exposed personal data, and cost millions to fix.
The threat is growing. Services need urgent, ongoing action to stay safe.
What to Watch Next
Proposed police and local government reforms could include stronger cyber resilience.
If these reforms include dedicated funding and leadership roles, they could transform digital safety in public services.
Michele Skeer from HMICFRS said: ‘The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario—it has already happened, and the consequences have been severe.’
She stressed that cybersecurity must be a core priority. It should be part of daily operations, not an afterthought.
The report shows a deep leadership gap. Cybersecurity is not treated as a daily concern. While some progress has been made, many services still need urgent improvements.
For more on digital resilience in public services, see the original report at Independent.
Sources & further reading
Featured image: original publisher image. Via original publisher. Image source
