Malware Statement
A message from the Merseyside Police Federation - Dave Lowe, Secretary and Tony Fairclough, Chairman:
On Saturday 9 March 2019, the Police Federation England and Wales (PFEW) systems' security alerted to a ransomware cyber-attack which affected many of the systems used by the Police Federation of England and Wales, at their headquarters in Surrey.
There is no evidence at this stage that any data was extracted from PFEW's systems, although this cannot be discounted at this stage. Whilst PFEW consider at this stage the risk of data being extracted or misused is low, PFEW wanted to alert members as to the risk at the earliest opportunity.
One of the databases affected held personal data about police federation members. The National Membership Database includes the name, rank and serving force of around 120,000 police officers up to the rank of Chief Inspector, along with their police email address and National Insurance number.
A second database relates to a booking system for the conference and hotel facilities in Leatherhead and includes the names, addresses, and email addresses of guests who have stayed there for leisure purposes. If the stay was between 1 September 2018 and 9 March 2019 then this will also include any credit card number used, including the expiry date. This does not affect those who have stayed there as Federation representatives or attending courses.
Those concerned about fraud or lost data should contact Action Fraud. Action Fraud's online fraud reporting tool is available any time of the day or night or call 0300 123 2040. For further information visit www.actionfraud.police.uk.
A third database relates to claims case management system. This is a data base for any members who have requested PFEW assistance for any investigation, inquiry or complaint during their service which has been dealt with by HQ at Leatherhead. This may in some cases include the member's name, address, National Insurance number, bank details and details of the case.
If it is identified that any of your data may have been extracted from the system or that there is any action you specifically need to take you will be contacted directly.
The PFEW are deeply sorry that this has happened and that data they hold about you has been affected and know that this will cause you some concern.
A website has been set up to provide dedicated information and advice, please visit http://advice.polfed.org/
Advice can also be obtained from the National Cyber Security Centre.
A helpline will also be available from noon on Friday 22 March on 0800 358 0714. Thereafter the opening hours will be Saturday and Sunday 9am to 3pm and Monday to Friday 8am to 6pm.
The PFEW have instructed a leading forensics firm to help investigate the matter. This is a complex process and will take some time. Indications are that it was not targeted specifically at PFEW and was likely part of a wider campaign.
PFEW take data security very seriously and have a number of technical and organisational measures in place to protect the data of members and others whose data they hold. On becoming aware of the attack, PFEW immediately reacted and put in place a number of measures in order to stop the further spread of the malware.
The PFEW have been working with the National Crime Agency who are dealing with this incident as a criminal offence and have been liaising with the National Cyber Security Centre and the Information Commissioner's Office. The PFEW continue to offer every cooperation as investigations continue. As soon as we have more information, we will communicate it to you.
A message from Merseyside Police Deputy Chief Constable Serena Kennedy:
'We appreciate that this will be concerning and we are working closely with the Police Federation whilst the situation is investigated. Your security is of the utmost importance and while it is currently thought that the risk of personal data being extracted, or misused, is low we will continue to work closely with the Federation to monitor the situation. If you do have any concerns please visit the website established by the Federation at http://advice.polfed.org/, which contains the most up-to-date information on the circumstances and the ongoing investigation. A dedicated helpline is also being set up by the Federation and this will be available from noon on Friday 22 March on 0800 358 0714."