Police and fire services in England and Wales are still not well prepared for cyber attacks. This is the finding of a report by the HMICFRS inspectorate, which oversees both services. The report was published on 27 October 2026.
Inspectors visited three police forces and three fire and rescue services. They spoke to leaders, security specialists and ordinary staff. They also assessed the work of national bodies, including the Police Digital Service.
The conclusions are worrying. Both services regularly assess their security and slow improvement can be seen. But many forces and services still have a long way to go to protect their systems effectively. The biggest risk is old IT systems, which all the organisations inspected relied on.
Inspectors also found weak passwords, no two-step login (MFA), poor access controls when staff join, move roles or leave, and in some places unsatisfactory backups. External IT suppliers are also a problem. They store sensitive police data, for example about victims and ongoing cases. Some service leaders admitted that cyber security is not part of their daily decision-making.
The report contains 13 recommendations. The most important are: a minimum security standard for all forces and services, external checks of fire services’ self-assessments, better contracts with IT suppliers and a national attack-monitoring centre for fire services – like the one the police already have. The inspectorate plans a re-inspection.
What it means for you
The police hold data on victims, witnesses and reports – including on Poles living in the UK. An attack on these systems could delay cases and expose private information. For business owners, the report is a ready-made checklist: the same mistakes – old software, no MFA, untested backups – happen in small firms.
Our assessment
The recommendations are sensible, but they require money to replace systems. Without budget decisions, improvement will be slow. It is good that the report addresses external suppliers – today they are the weakest link in many organisations, not only in the emergency services.
What to do
- Switch on two-step login (MFA) for email, banking and business systems.
- Make backups and check that data can be restored from them.
- Block former employees’ accounts on the day they leave.
- Use the NCSC’s free advice for small businesses: NCSC Small Business Guide and look at the scheme Cyber Essentials.
Source: HMICFRS – Cybersecurity in police forces and fire and rescue services (27 October 2026).
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
