--- title: Scottish Govt Suffers Potentially Widening Data Breach description: Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed that an external supplier managing an online data maturity assessment suffered a breach... canonical: https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Scottish Govt Suffers Potentially Widening Data Breach | daily.dev og:description: Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed that an external supplier managing an online data maturity assessment suffered a breach... og:url: https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso og:image: https://api.daily.dev/og/posts/U3Cg5Vxso.png og:image:alt: Scottish Govt Suffers Potentially Widening Data Breach og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Scottish Govt Suffers Potentially Widening Data Breach **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed that an external supplier managing an online data maturity assessment suffered a breach on Aug. 5, exposing employee PII (names, roles, work emails) for around 300 people. The breach may extend to other Scottish government agencies that took part in the same national Data Maturity Programme assessment. Dark Reading identified UK research firm Data Orchard as the likely administrator of the assessment, though it has not been publicly confirmed as the breached vendor. Security experts warn that even limited employee data can enable targeted phishing and that point-in-time vendor risk assessments are inadequate, urging continuous monitoring of supplier attack surfaces instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened in the Scottish government COPFS data breach? An external supplier running an online data maturity assessment for Scotland's Crown Office and Procurator Fiscal Service (COPFS) detected suspicious network activity on August 5, resulting in the loss of employee personal data. Around 300 individuals were affected, with names, roles, and work email addresses exposed, though case, victim, and witness data along with IP addresses were not compromised. _Track how third-party vendor breaches unfold and spread across government agencies with daily.dev._ ### Why is point-in-time vendor security assessment considered insufficient? A one-time questionnaire or certificate like SOC 2 or ISO 27001 at onboarding goes stale almost immediately, leaving peripheral suppliers like one-off assessment vendors off continuous monitoring lists. Security researchers argue organizations should shift from annual attestation to continuous, outside-in monitoring of a supplier's live attack surface, extending visibility into vendors' own dependencies, a direction regulations like NIS2 and DORA are already pushing. _Compare vendor risk management approaches like daily.dev users tracking evolving supply chain security practices._ ## Similar posts on daily.dev - [Exposed: Woeful security at UK criminal records office that led to sensitive data leak](https://daily.dev/posts/exposed-woeful-security-at-uk-criminal-records-office-that-led-to-sensitive-data-leak-zehm7fdxd) · The Register · 0 upvotes · 0 comments - [Experts react as Department for Education cyber attack exposes 607,000 records](https://daily.dev/posts/experts-react-as-department-for-education-cyber-attack-exposes-607-000-records-sxxsbkgsk) · IT Security Guru · 0 upvotes · 0 comments - [Swiss prosecutors investigate data leak at federal pension fund Publica](https://daily.dev/posts/swiss-prosecutors-investigate-data-leak-at-federal-pension-fund-publica-wv7yk7nex) · The Next Web · 0 upvotes · 0 comments - [Student Data at Risk: What the Victoria Education Breach Exposes About Public Sector Security](https://daily.dev/posts/student-data-at-risk-what-the-victoria-education-breach-exposes-about-public-sector-security-gw9wkbjsv) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach), [#phishing](https://daily.dev/tags/phishing), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Scottish Govt Suffers Potentially Widening Data Breach","url":"https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso"},"datePublished":"2026-08-14T16:41:41.287Z","dateModified":"2026-10-14T02:23:31.355Z","description":"Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed that an external supplier managing an online data maturity assessment suffered a breach...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b0a3d1817191c34747699675660d0dba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b0a3d1817191c34747699675660d0dba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach,phishing,security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Scottish Govt Suffers Potentially Widening Data Breach"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/scottish-govt-suffers-potentially-widening-data-breach-u3cg5vxso#faq","mainEntity":[{"@type":"Question","name":"What happened in the Scottish government COPFS data breach?","acceptedAnswer":{"@type":"Answer","text":"An external supplier running an online data maturity assessment for Scotland's Crown Office and Procurator Fiscal Service (COPFS) detected suspicious network activity on August 5, resulting in the loss of employee personal data. Around 300 individuals were affected, with names, roles, and work email addresses exposed, though case, victim, and witness data along with IP addresses were not compromised. Track how third-party vendor breaches unfold and spread across government agencies with daily.dev."}},{"@type":"Question","name":"Why is point-in-time vendor security assessment considered insufficient?","acceptedAnswer":{"@type":"Answer","text":"A one-time questionnaire or certificate like SOC 2 or ISO 27001 at onboarding goes stale almost immediately, leaving peripheral suppliers like one-off assessment vendors off continuous monitoring lists. Security researchers argue organizations should shift from annual attestation to continuous, outside-in monitoring of a supplier's live attack surface, extending visibility into vendors' own dependencies, a direction regulations like NIS2 and DORA are already pushing. Compare vendor risk management approaches like daily.dev users tracking evolving supply chain security practices."}}]} ```