Scotland’s Crown Office and Procurator Fiscal Service (COPFS) — the country’s national prosecution authority — has disclosed that a third-party supplier experienced a data security incident that exposed personal information belonging to around 300 of its staff members. The supplier was running a national data maturity assessment on behalf of the Scottish Government, and it detected suspicious activity on its systems on August 5. It subsequently secured the affected systems and notified COPFS.
The information exposed is limited to employment data connected with the survey: names, job roles, and work email addresses. The breach did not involve any casework, confidential case files, or other sensitive prosecution data. However, because other Scottish Government agencies also participated in the same survey, the total number of people affected across the public sector is likely to be larger than the 300 COPFS employees identified so far. The supplier and Scottish Government officials are still assessing the full scope.