World news and discussion on TalkFuse.
Scottish prosecutors cast eye over leaky supplier after staff data exposed
Scotland’s public prosecution service has warned around 300 employees that their work-related personal details may have been exposed after suspicious activity was detected at an unnamed third-party supplier. The Crown Office and Procurator Fiscal Service said its own systems, casework and confidential case information were unaffected, but the breach could increase the risk of targeted phishing or scam attempts against staff.
The affected information came from an online public-sector data maturity assessment completed last year and may include names, job roles and work email addresses. The supplier detected the activity on 5 August, has secured its systems and is investigating the intrusion and accessed data; authorities have not confirmed whether it is linked to a recently disclosed Metabase cloud-service vulnerability.
In short
- About 300 Scottish prosecution staff may be affected.
- Only work contact and employment details were potentially exposed.
- Casework and COPFS systems were not compromised.
Explained simply
Scotland’s Crown Office and Procurator Fiscal Service (COPFS) is the public body that prosecutes crimes and investigates sudden or suspicious deaths. It employs staff in roles that support this work, alongside prosecutors.
Public bodies sometimes use outside suppliers to provide online services or handle assessments. If information held by a supplier is exposed, details such as work email addresses can be used in targeted scam messages, even when the public body’s own systems and confidential case files are unaffected.
The incident concerns information from a public-sector assessment carried out for COPFS. It matters because staff may face a greater risk of phishing, while the supplier and authorities investigate what was accessed and how.