Key Points
- Dyfed-Powys Police Force has confirmed that it suffered from a cyber attack which was discovered on Monday, 14 September 2026.
- This attack caused disruption in some non-emergency systems.
- The force is trying to establish if the information related to its staff was accessed and breached.
- According to Dyfed-Powys Police, it has found no evidence of any access or breach of personal information belonging to members of the public.
- The Information Commissioner’s Office has been informed.
- The force states that it is fully functional and its response to emergencies has not been affected.
- Phone services, including the 999 and 101 lines, were unaffected, although there was temporary inability to contact the police via online and email, which is now fixed.
- Cyber security experts are assisting with the investigation and some preventive measures are taken regarding the systems.
- Dyfed-Powys Police Force covers Carmarthenshire, Ceredigion, Pembrokeshire, and Powys, and is the third largest police force in the UK by area.
Wales (Wales Times) September 25, 2026 – The force confirmed that it was subject to a cyber incident identified on 14 September 2026. As reported by the BBC, Dyfed-Powys Police said the attack could have led to staff information being “accessed or compromised”.
In a statement quoted by the Daily Mail, the force said: “We can confirm that the force has been subject to a cyber incident which was identified on Monday September 14, 2026.” It added that the incident “caused disruption to some non-emergency systems”.
Nation.Cymru reported that Dyfed-Powys Police is investigating whether information relating to its staff may have been accessed or compromised during the cyber incident.
Has public data been affected?
At this stage, the force says its investigation has found no evidence that personal data belonging to members of the public has been accessed or compromised. The Daily Post likewise reported that no personal data relating to members of the public had been compromised, according to the force.
Dyfed-Powys Police said:
“At this stage, our investigation has found no evidence that members of the public’s personal data has been accessed or compromised as a result of this incident.”
The force added that it is continuing to investigate whether staff-related information may have been accessed or compromised, and that it is taking steps to protect that information. It said it would provide appropriate advice to colleagues if required.
Which police services were disrupted?
Some non-emergency systems were disrupted following the incident. The force said online and email contact were unavailable for a period, but have since been restored.
Telephone services were not affected. Dyfed-Powys Police stated that both 999 and 101 services remained available and that its response to emergency incidents had not been affected.
“The force remains fully operational, and our response to emergency incidents has not been affected,” the force said in the statement reported by the Daily Mail.
What action has the force taken?
Since identifying the incident, Dyfed-Powys Police has been investigating the circumstances surrounding it with support from cyber-security specialists. It said “appropriate action” has been taken and systems have been subject to precautionary measures while specialist teams investigate and restore services safely.
The Information Commissioner’s Office has been notified. The ICO is the UK’s independent regulator for data protection and information rights.
The force said: “We understand the potential concern this may cause and want to reassure the public that we have and will continue to take all necessary steps to protect our information and maintain the security of our systems.”
A police spokesperson said updates would be provided “when we are in a position to do so”, according to the Daily Mail.
What is Dyfed-Powys Police?
Dyfed-Powys Police serves communities in Carmarthenshire, Ceredigion, Pembrokeshire and Powys.
As reported by LBC, it is the third-largest police force in the United Kingdom by geographic area, after Police Scotland and the Police Service of Northern Ireland.
The Daily Mail reported that the force had almost 1,300 police officers last year and operated across around 40 police stations.
Background of the development
Dyfed-Powys Police has published cyber-security and information-security policies setting out expectations for staff to report suspected or actual cyber-security events through dedicated channels, including its Workstream Tracker system and ICT Service Desk.
Its published information-security policy also states that, where appropriate, the force may restrict or terminate system access, disclose matters to law-enforcement or regulatory agencies, take legal action, or refer incidents to its Professional Standards Department for investigation.
The current incident was reported publicly on 25 September 2026 by several UK outlets, including the BBC, Nation.Cymru, LBC, the Daily Post, the Daily Mirror and the Daily Mail.
Prediction: How could this affect residents and staff?
For residents across Dyfed-Powys, the immediate practical effect appears limited: emergency calls through 999, non-emergency calls through 101 and the force’s emergency response remain available. Residents may nevertheless experience slower responses to some online or email-based non-emergency enquiries if further system checks or restoration work are required.
For police staff, the most significant risk is the potential exposure of personal or work-related information. If the investigation confirms that staff data was accessed, affected colleagues may require individual advice, support and security measures; the force has already said it will provide appropriate advice if needed.
For the wider public, the incident may prompt closer scrutiny of how police forces protect internal systems and staff records, particularly where cyber-security specialists and regulators such as the ICO become involved. The force’s public reassurance—that there is currently no evidence of compromised public data will likely be assessed against the findings of its ongoing investigation.
