Met police expose email addresses of 143 Al Fayed victims in data breach

On Tuesday, 11 August 2026, the Metropolitan Police in London, United Kingdom, committed a serious data breach when it accidentally exposed the email addresses of 143 alleged victims of the late Harrods owner Mohamed Al Fayed. The breach occurred during a routine monthly email update sent to victims who had signed up to receive progress reports on Operation Cornpoppy, the police investigation into individuals who may have facilitated or enabled Al Fayed's sexual offending. Instead of using the blind carbon copy (BCC) function to hide recipients' addresses, officers copied all recipients into the 'To' field, making their email addresses visible to everyone on the distribution list. The list included 159 recipients in total, of whom 143 were alleged victims, many of whom had chosen to remain anonymous. The force identified the error quickly and took immediate action, but the damage was done: victims' identities were exposed to each other, and the breach was reported to the Information Commissioner's Office (ICO).

The email update also revealed that three additional suspects, one in their 70s and two in their 80s, had been interviewed under caution, bringing the total number of suspects interviewed to seven. This information was part of the ongoing investigation into Al Fayed's alleged crimes, which include rape, sexual assault, human trafficking, false imprisonment, drugging, physical violence, and forced abortions. Al Fayed, who died in August 2023 at the age of 94, is accused of abusing around 400 women and girls between the late 1970s and early 2000s, many of whom were young employees at his businesses, including Harrods. The Metropolitan Police has faced significant criticism for its handling of these allegations, with some victims claiming that their reports were not taken seriously for years.

This is not the first time the Met has breached the privacy of Al Fayed's alleged victims. Earlier in 2026, Joanna Brittan, a survivor who has spoken publicly about being trafficked by Al Fayed and raped by one of his associates, discovered that the force had sent sensitive information about her to another victim in Australia. In that incident, the Met disclosed details of her first police interview to two people in Australia, for which she was offered compensation. Brittan expressed her frustration, stating that she had been promised that the force had learned from its mistakes and that such a breach would not happen again. The latest breach has further eroded trust in the police investigation, with survivor advocacy groups such as Justice for Fayed and Harrod Survivors describing the incident as "appalling" and demanding answers about how the force plans to protect victims' data in the future.

The Metropolitan Police has apologised for the breach, attributing it to "human error" and stating that it is being investigated "as a matter of priority." The force has also said it is reviewing its processes to prevent similar incidents from occurring again. However, the breach has raised serious concerns about the safety and well-being of the victims, many of whom have chosen to remain anonymous to protect themselves from potential harassment or retaliation. The force has said it is considering providing further support and safeguards for the victims, but the damage to their trust may be irreparable. The incident also highlights the broader challenges faced by law enforcement in handling sensitive data in high-profile cases involving numerous victims, and the need for robust data protection measures to ensure that such breaches do not happen again.