This Week's Cyber Radar

1. Legal Aid Agency breach reaches back decades

The Ministry of Justice now says about 250,000 stolen Legal Aid Agency records predate 2007, with the earliest dating to 1978, following an attack first detected in April 2025. The data can include names, addresses, National Insurance numbers and legal proceedings details, although the government has no sign it has been published. However, the update does not explain why records from the 1970s were still accessible, which makes retention a practical question for any organisation holding long-lived records.

2. Met Police reprimanded over unapproved platform

The ICO has reprimanded the Metropolitan Police after staff uploaded details of 179 people to Auror, a platform retailers use to track shoplifters. Officers opened 500 accounts, 375 of them in active use, after the supplier made sign-up easy, and no data protection check took place. In short, tools that spread by word of mouth can create regulatory exposure long before a central team notices.

3. Fashion group systems offline after attack

TFG London, which owns Hobbs, Phase Eight and Whistles, found an incident on 11 October and still had several systems offline two days later. Stores stayed open and the company says it has no reason to think payment data is at risk, but online orders were delayed. However, the cause and recovery time are undisclosed, which is why continuity plans should cover several days of partial service rather than a few hours.

4. Backup supplier attack reaches Microsoft 365 tenants

Attackers used the approved permissions of a ConnectWise cloud backup service to enter Microsoft 365 tenants, with one security firm counting at least 162 affected. Because the sign-ins came from an automated script acting as the application, multi-factor authentication did not stop them. Notably, ConnectWise suspended the service and said backups had stopped and restores were unavailable, so customers lost their safety net as well.

5. Supplier account opens Danish population register

Denmark's government says information on 8.8 million people was accessed from its central population register, and the IT supplier involved has confirmed its access was exploited. The intruder reportedly ran about 14 million automated searches between 10 and 20 September, and the breach was found on 2 October. However, the claim that a password of 123456 was used is unconfirmed, so the firm lesson is simpler: supplier access needs monitoring as closely as your own.

Not sure which suppliers and data deserve your attention first?

Our team can talk through practical next steps in plain language.