Met apologises for exposing 143 email addresses of Mohamed Al Fayed victims
The Metropolitan Police has apologised after accidentally revealing the email addresses of 143 alleged victims of Mohamed Al Fayed in a group update on its investigation. The force described the breach as human error, referred itself to the Information Commissioner’s Office and said it was urgently reviewing its procedures, amid existing criticism of its treatment of survivors.
The email update said three further suspects had been interviewed under caution over allegations they may have enabled or facilitated Fayed’s offending, bringing the total to seven. More than 400 allegations of sexual misconduct concerning Fayed, who died in 2023 without being charged, have been made relating to 1977-2014; the Met is investigating claims from at least 155 victims through Operation Cornpoppy.
- Met exposed 143 alleged victims’ email addresses in an update.
- Police blamed human error and referred themselves to the regulator.
- Seven suspects have now been interviewed under caution.
New here? Start with this
Mohamed Al Fayed, the former owner of Harrods, died in 2023. More than 400 allegations of sexual misconduct have been made about him, covering the years 1977 to 2014; he was never charged. The Metropolitan Police is investigating claims from at least 155 people as part of Operation Cornpoppy.
The investigation also includes questions about whether other people may have enabled or helped facilitate Fayed’s alleged offending. The case matters to survivors seeking answers about what happened and whether others were involved. The police’s handling of information about alleged victims is also under scrutiny.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The incident is particularly concerning given documented criticism of the Met's broader handling of the Fayed investigation and treatment of survivors. Exposing 143 victims' email addresses represents a serious breach of vulnerable people's trust and suggests systemic failures in data protection protocols. Such incidents demand more than apology and internal review; they warrant deeper institutional scrutiny and reform in how the Met safeguards victim confidentiality throughout sensitive investigations.
The case against
Whilst the breach was serious, the Met has responded appropriately through immediate apology, independent referral to the Information Commissioner's Office, and urgent procedural review. The force has transparently accepted accountability for a human error and committed to systemic improvements. This measured institutional response—combining clear responsibility with external oversight and concrete reform—represents proper practice in addressing human mistakes.