Inspectorate Warns UK Emergency Services Face Critical Cyber Risks

A report published October 27 by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services warns that police and fire services across England and Wales are under-prepared for an expanding cyberattack threat. Based on inspections conducted between January and May 2026, the watchdog identified critical vulnerabilities stemming from outdated legacy IT infrastructure, poor password management, and inadequate multi-factor authentication.

Inspectorate head Michelle Skeer attributed these weaknesses to a leadership failure, stating that senior officials often exclude cybersecurity from daily operational decisions. The report highlights that reliance on third-party ICT suppliers has exposed sensitive intelligence and investigation data, while unsatisfactory backup and restoration capabilities could lead to prolonged operational disruptions. These warnings follow a disruptive incident at Dyfed-Powys Police and security alerts issued to the Metropolitan Police Service.

To mitigate these risks, the inspectorate issued 13 recommendations, including the creation of a national cybersecurity capability for fire services and mandatory Cyber Essentials certification for third-party suppliers. In response, Thames Valley Police and Oxfordshire County Council defended their current systems as robust. Jonathan Dyson, Chief Fire Officer of North Yorkshire Fire and Rescue Service, noted that cybersecurity is now a resilience issue affecting organizational continuity.