Metropolitan Police Apologizes After Email Breach Exposes Victims of Alleged Abuse by Mohamed Al Fayed
The Metropolitan Police has issued an apology after accidentally disclosing the email addresses of approximately 140 individuals who reported sexual abuse linked to the late Harrods owner Mohamed Al Fayed. The breach occurred on 11 August when a monthly update regarding Operation Cornpoppy the Met’s investigation into those who may have enabled Al Fayed’s alleged offenses was sent with recipients visible in the "To" field rather than blind-copied.
The update also revealed that three additional suspects, all in their 70s and 80s, had been interviewed under caution, bringing the total number of interviewees to seven. The force confirmed it had self-referred to the Information Commissioner’s Office (ICO) and is assessing further support for victims, along with enhanced safeguards.
A spokesperson stated that the error was identified quickly, and affected individuals were contacted the same day. While the breach exposed email addresses within smaller recipient groups rather than the full cohort of 140 subscribers, the Met acknowledged the potential impact on victims. The incident has been formally recorded, and the force is reviewing alternative communication methods to prevent future breaches.
Operation Cornpoppy has received 154 reports of abuse connected to Al Fayed, with victim support remaining a priority. The Met emphasized its commitment to providing updates while addressing the fallout from the breach.
Source: https://www.bbc.co.uk/news/articles/c1w1yv987jqo
Metropolitan Police TPRM report: https://www.rankiteo.com/company/metpoliceuk
"id": "met1786811088",
"linkid": "metpoliceuk",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '140',
'industry': 'Public Sector',
'location': 'United Kingdom',
'name': 'Metropolitan Police',
'size': 'Large',
'type': 'Law Enforcement Agency'}],
'attack_vector': 'Human Error',
'customer_advisories': 'Affected individuals contacted directly',
'data_breach': {'data_exfiltration': 'No',
'number_of_records_exposed': '140',
'personally_identifiable_information': 'Email Addresses',
'sensitivity_of_data': 'High (Victims of alleged abuse)',
'type_of_data_compromised': 'Email Addresses'},
'date_detected': '2023-08-11',
'date_publicly_disclosed': '2023-08-11',
'description': 'The Metropolitan Police accidentally disclosed the email '
'addresses of approximately 140 individuals who reported '
'sexual abuse linked to the late Harrods owner Mohamed Al '
'Fayed. The breach occurred when a monthly update regarding '
'Operation Cornpoppy was sent with recipients visible in the '
"'To' field rather than blind-copied.",
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Email Addresses',
'identity_theft_risk': 'Low',
'legal_liabilities': 'Potential ICO investigation',
'operational_impact': 'Review of communication methods, enhanced '
'safeguards',
'systems_affected': 'Email Communication System'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Need for stricter email handling protocols, alternative '
'communication methods for sensitive updates',
'post_incident_analysis': {'corrective_actions': 'Review of communication '
'methods, enhanced '
'safeguards',
'root_causes': 'Human error in email handling'},
'recommendations': 'Implement BCC for bulk emails, conduct regular training '
'on data protection, enhance safeguards for victim '
'communications',
'references': [{'date_accessed': '2023-08-11',
'source': 'Metropolitan Police Statement'}],
'regulatory_compliance': {'regulations_violated': 'UK Data Protection Act, '
'GDPR',
'regulatory_notifications': 'Self-referral to ICO'},
'response': {'communication_strategy': 'Apology issued, self-referral to ICO',
'containment_measures': 'Affected individuals contacted the same '
'day',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Review of alternative communication '
'methods, enhanced safeguards'},
'stakeholder_advisories': 'Victims offered further support, ICO notified',
'title': 'Metropolitan Police Email Breach Exposes Victims of Alleged Abuse '
'by Mohamed Al Fayed',
'type': 'Data Breach',
'vulnerability_exploited': 'Improper Email Handling'}