The Metropolitan Police has apologised after an internal error exposed the email addresses of roughly 140 people who say they were sexually abused by the late Harrods owner Mohamed Al Fayed.
The disclosure occurred when a monthly update about Operation Cornpoppy – the Met’s inquiry into those who may have facilitated or enabled offending by Al Fayed – was sent with recipients visible to one another rather than blind-copied. The email, sent on 11 August, also noted that a further three men in their 70s and 80s had been interviewed under caution, bringing the number questioned about the investigation to seven.
The force said the mistake was the result of human error, that the matter was identified quickly and that everyone affected was contacted on the day the breach was discovered. It has self-referred the incident to the Information Commissioner’s Office (ICO) and recorded the event within investigation files.
"Due to human error, recipients' email addresses were visible to others on the distribution list. The issue was identified quickly and immediate action was taken. We understand the impact this may have on victims and sincerely apologise," a Met spokesperson said.
Immediate responses and potential consequences
Scotland Yard said it was considering further victim support and implementing additional safeguards to prevent a repeat. Victims who had opted in to receive updates were split into smaller groups for the distribution, the force added, meaning the exposure was limited to those sub-groups rather than the full cohort.
The incident brings into focus the risks of electronic communication in sensitive criminal inquiries and poses questions about the Met’s handling of personal data during high-profile investigations. By referring itself to the ICO, the force has signalled it expects regulatory oversight and possible scrutiny of data-handling processes.
- Approximate number affected: 140 people who had signed up for updates.
- Allegations reported to date: 154 victims have made reports linked to Al Fayed, the Met has previously said.
- Suspects interviewed under caution: Seven in total, including three newly reported as in their 70s and 80s.
Context of the inquiry
Operation Cornpoppy is investigating whether any individuals may have helped or enabled sexual offending by Al Fayed. The force has emphasised that supporting survivors remains central to the investigation.
Recording the breach in the investigation records indicates the force intends to monitor the circumstances and the impact on those affected. It also said it would review alternative ways of updating victims that would lower the risk of similar data exposure in future.
What victims and the public may expect next
Victims contacted directly on the day of the incident will likely be offered further information about the breach, and the Met has said it is “considering providing further support” to them. The ICO will determine whether regulatory action or enforcement is warranted following its assessment.
The episode is apt to intensify debates about procedural safeguards for victims' privacy in policing communications, especially in investigations tied to prominent figures. It may also prompt forces to review routine email protocols and victim-updating practices to reduce human error risks.
| Item | Figure |
|---|---|
| People who signed up for updates | ~140 |
| Total alleged victims reported to Met | 154 |
| People interviewed under caution | 7 |
The Met’s acknowledgement that the breach was recorded and that processes are being reviewed offers some assurance of internal action, but the referral to the ICO underscores the seriousness of the data protection implications. For survivors who have already come forward, the exposure of contact details can be deeply distressing and may complicate trust in the investigative process.
