London police apologise for exposing Al-Fayed victims' emails in data breach
The Metropolitan Police has apologised after email addresses of women who have accused late Harrods owner Mohamed Al-Fayed of sexual abuse were accidentally shared with other recipients on a distribution list.
The data breach occurred on Tuesday, when the force sent a monthly update to complainants but failed to conceal the recipients' email addresses using the “blind carbon copy” (BCC) function. As a result, the addresses were visible to everyone on the list.
According to BBC News, around 140 women were affected. U.K. media reported that the Information Commissioner's Office (ICO), the country's data protection regulator, has been notified of the incident.
In a statement, the Met said: “Due to human error, recipients' email addresses were visible to others on the distribution list.” The force stated that the issue was identified quickly and immediate action was taken, with affected individuals contacted directly on the same day.
“We understand the impact this may have on victims and sincerely apologise,” the statement continued. “The incident is being investigated as a matter of priority, and we are reviewing our processes to help prevent a similar breach from happening again.”
The apology comes amid an ongoing police investigation into allegations against Al-Fayed, who died in 2023 at the age of 94. So far, 157 victims have reported complaints to the Met, including sexual assault, rape, sexual exploitation and human trafficking.
Al-Fayed, an Egyptian business tycoon, acquired Harrods in 1985 and also owned the Ritz hotel in Paris. He faced multiple complaints during his lifetime, but none resulted in prosecution. The allegations against him gained widespread attention following a 2024 BBC documentary, which prompted many former employees to come forward.
In total, 259 victims have applied for compensation under a redress scheme launched by Harrods last year. The scheme was set up by the store's current owners, the Qatar Investment Authority, which acquired Harrods in 2010. The independent scheme aims to provide financial support and access to counselling for those affected.
The Met has so far questioned six people suspected of enabling Fayed's offences, but no arrests have been made.
Data protection experts have noted that exposing the identities of sexual abuse complainants can pose serious safety and privacy risks. The ICO will examine whether the force complied with U.K. data protection laws and may issue a penalty or require changes to its procedures.
The Met has assured victims that it is treating the incident with the utmost seriousness and is offering support to those affected. The force said it is reviewing its email distribution protocols to ensure that such a breach cannot happen again.
