Police Federation data breach: Keller Lenkner UK serves group litigation notice

Group action litigation law firm Keller Lenkner UK has served notice to the Police Federation of its intention to seek a Group Litigation Order from the High Court in early 2022. The order relates to a 2019 data breach which compromised personal information relating to thousands of police officers.

The firm’s data breach team is representing officers seeking compensation for the Police Federation's failure to adequately protect officers’ personal and sensitive data when the Police Federation Membership database suffered a ransomware cyber-attack.

The initial attack took place on 9 March 2019, followed by a further and more sustained attack on 21 March 2019, which impacted a number of vital systems.

During the later attack, the Police Federation suffered a severe data breach. It was locked out of its own systems and lost control of members’ data. Cybercriminals potentially accessed the personal information of around 120,000 members, with officers at all levels affected. Some officers may have also had their financial details put at risk. Despite being obliged to inform potentially affected parties under the GDPR, the Police Federation failed to inform officers until two weeks later.

An investigation by Keller Lenkner suggested the Police Federation did not have adequate data security processes in place. The firm has been building a group of impacted officers, and has informed the Police Federation of its intention to seek a Group Litigation Order. Causes of action are likely to include financial losses, distress and loss of privacy.