Met Police apologises for exposing email addresses of 143 alleged Al Fayed victims

The Metropolitan Police has issued an apology after inadvertently exposing the email addresses of 143 alleged victims of Mohamed Al Fayed, the late owner of Harrods, in a serious data breach that has reignited concerns over the force's handling of one of the most significant sexual abuse investigations in British history.

The breach occurred on Tuesday as officers issued a monthly update to victims regarding the progress of the investigation into Al Fayed, who died in 2023 aged 94. The update confirmed that a further three suspects — one aged in their 70s and two in their 80s — had been interviewed under caution, bringing the total number of suspects interviewed under caution as part of the investigation to seven.

The force told The Independent that the email addresses of 143 alleged victims were revealed, with recipients' contact information visible to others on the distribution list. The Met did not confirm the exact number of people affected by the leak, though it is understood that all victims who opted in to receive updates from the investigation team were affected, with recipients split into smaller groups meaning addresses were only visible to those within each group.

Data breach: What happened and who is affected

The incident took place on Tuesday 11 August 2026, according to The Times, as the Met's investigation team sent out its routine monthly update to victims. The breach affected all victims who had opted in to receive updates from the investigation team, but the force has stressed that recipients were divided into smaller groups, which meant the email addresses were only visible to those within each respective group rather than to all 143 recipients simultaneously.

Despite this mitigation, the exposure of contact details for individuals who have alleged sexual abuse raises profound safeguarding concerns. Many of these victims have spent years seeking anonymity and protection from potential reprisals, and the disclosure of their email addresses — even to other alleged victims — represents a significant failure in the duty of care owed to them by the investigating force.

The Met confirmed that those affected were contacted directly on the day of the incident, and the Information Commissioner's Office (ICO) has been notified. The impact of the breach will be monitored, the force said, though questions remain about how such an error occurred and what immediate steps have been taken to prevent a recurrence.

The wider investigation: 400 claims spanning four decades

The breach comes against the backdrop of an investigation that has already drawn intense scrutiny. More than 400 claims of sexual misconduct have been made against Al Fayed, dating between 1977 and 2014, including allegations of rape and human trafficking. The scale of the allegations — which emerged following a BBC documentary and subsequent reporting — has prompted one of the largest investigations of its kind into a single individual in British policing history.

Al Fayed, the Egyptian businessman who owned Harrods from 1985 to 2010, has been accused of abusing female staff members and others over a period spanning nearly four decades. The allegations, which have only come to light in significant numbers since his death, have raised difficult questions about how such conduct was able to continue unchecked for so long, and whether the police and other institutions failed to act on earlier complaints.

The investigation, led by the Met's Directorate of Professional Standards under the direction and control of the Independent Office for Police Conduct (IOPC), is examining not only the allegations against Al Fayed himself but also the conduct of those who may have facilitated his offending. The three new suspects interviewed under caution — one in their 70s and two in their 80s — bring the total number of individuals interviewed under caution as part of the investigation to seven.

The Met's response: Apology and review of processes

In a statement issued to The Independent, a Met Police spokesperson said: "On Tuesday, 11 August 2026, officers issued a monthly update to victims regarding progress in our investigation into those who may have facilitated Mohamed Al Fayed's offending. The update was to confirm a further three suspects, one aged in their 70s and two in their 80s, have recently been interviewed under caution, bringing the total number interviewed under caution as part of the investigation to seven. Enquiries remain ongoing."

The spokesperson continued: "Due to human error, recipients' email addresses were visible to others on the distribution list. The issue was identified quickly and immediate action was taken. We understand the impact this may have on victims and sincerely apologise. Everyone affected was contacted directly on the day of the incident. The incident is being investigated as a matter of priority, and we are reviewing our processes to help prevent a similar breach from happening again."

The apology, while unequivocal, will do little to assuage the concerns of victims who have already expressed deep dissatisfaction with the Met's handling of the case. The admission that the breach was the result of "human error" will also raise questions about the adequacy of the force's data protection protocols, particularly in a case of this sensitivity where the safety and wellbeing of alleged victims must be paramount.

Watchdog scrutiny: IOPC complaints and officer investigations

The data breach is not the first time the Met has faced criticism over its handling of the Al Fayed investigation. In June, three victims complained about the force to the Independent Office for Police Conduct, on top of investigations into one serving and four former Met officers for potential misconduct relating to the case.

An IOPC spokesperson said on 27 June: "We can confirm that we received complaints this week from three victim-survivors, which relate to the Met's handling of allegations against Mohamed Al Fayed and his associates that were reported to the force between 2018 and 2024. We are currently assessing these complaints before deciding what further action we will be taking."

The complaints relate to the Met's handling of allegations reported between 2018 and 2024 — a period that predates the current investigation and raises questions about whether earlier reports were properly acted upon. The ongoing probe, led by the Met's Directorate of Professional Standards under the watchdog's direction and control, also involves other reports made by four victims, suggesting a pattern of concerns about the force's approach to the case.

The investigation into one serving and four former Met officers for potential misconduct adds another layer of complexity to an already fraught situation. The fact that serving and former officers are being investigated in connection with the Al Fayed case raises uncomfortable questions about whether the force's relationship with the late Harrods owner — who was known for his lavish lifestyle and close associations with figures in politics, media and the establishment — may have influenced policing decisions.

Analysis: What this means for victims and police accountability

This week's data breach represents a significant failure in the Met's duty of care to alleged victims, and it comes at a time when public confidence in the force is already under strain. For victims who have come forward to report abuse — often at great personal cost — the exposure of their contact details, even to other victims, will be deeply distressing and may deter others from coming forward.

The breach also raises broader questions about the Met's capacity to handle investigations of this scale and sensitivity. The force has acknowledged that it is reviewing its processes to prevent a similar breach from happening again, but for the 143 victims affected, the damage may already be done. The psychological impact of having one's contact details exposed in connection with allegations of sexual abuse cannot be overstated, and the Met's apology, while necessary, will not undo the harm caused.

The timing of the breach is particularly unfortunate, coming as it does amid ongoing scrutiny of the Met's handling of the Al Fayed case. The IOPC complaints lodged in June, combined with the investigations into serving and former officers, suggest that the force's relationship with the late Harrods owner and his associates is under intense examination. The fact that the Met has had to apologise for a data breach while simultaneously trying to reassure victims of its commitment to the investigation will do little to inspire confidence.

For the victims, the breach is yet another example of the system failing them. Many have waited years for justice, and the investigation into Al Fayed's offending — which spans allegations dating back to 1977 — has already been criticised for its slow pace. The fact that suspects are only now being interviewed under caution, decades after the alleged offences took place, will be a source of frustration for those who have campaigned for accountability.

The Met's commitment to reviewing its processes is welcome, but it must be accompanied by tangible action. The force must demonstrate that it can handle this investigation with the sensitivity and rigour it demands, and that the safety and wellbeing of victims will be prioritised at every stage. The ICO's involvement will provide some oversight, but the real test will be whether the Met can rebuild the trust of those who have placed their faith in the justice system.

As the investigation continues, with seven suspects now interviewed under caution and more than 400 claims under consideration, the pressure on the Met to get this right has never been greater. The victims of Mohamed Al Fayed deserve nothing less than a thorough, transparent and victim-centred investigation. This week's breach suggests that, at least in some respects, the force still has a long way to go.

By Erica Thornton, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: The Independent, The Times, Metropolitan Police, Independent Office for Police Conduct.