Met Police Exposes Email Addresses in Al Fayed Survivor Update

The Metropolitan Police has apologised after a monthly email about Operation Cornpoppy exposed recipients' email addresses to other people on the distribution list. Operation Cornpoppy is the investigation into people who may have facilitated or enabled alleged offending by the late Mohamed Al Fayed.

The force told the BBC that the 11 August update used visible recipient addressing instead of blind copying. Recipients had been divided into smaller groups, so addresses were not shown across the entire cohort. The BBC reports that around 140 people had signed up for updates; that is not the same as saying every address was exposed to every other subscriber.

In an ordinary mailing-list error, an exposed address may create spam risk. Here, membership of the list itself links a person to an exceptionally sensitive sexual-abuse investigation. One survivor who has waived her anonymity told the BBC that her address was visible to 42 other survivors and that she could see theirs.

The Met says it identified the issue quickly, contacted everyone affected on the day and formally recorded the incident. It has referred itself to the Information Commissioner's Office, is considering further support and safeguards, and says it will review alternative ways to update victims that reduce the risk of human error.

This incident follows separate ICO action published on 5 August. In that earlier case, the regulator issued the Met with an enforcement notice and reprimand over two unrelated disclosures and found broader weaknesses in training, policies and assurance. One of those incidents also involved sensitive recipients being placed visibly in an email's To field.

The new survivor-update disclosure is not one of the two cases covered by that enforcement notice. Its significance is that another similar workflow failed after the regulator had already required organisational improvements. The facts do not establish whether the new error breached the notice; the ICO referral and the Met's investigation now matter.

Keep the original message, the Met's notification and any follow-up in a secure place. Be cautious with unexpected email, calls or social messages that mention Operation Cornpoppy, Al Fayed or survivor support: exposed context can make impersonation more convincing even when no password or financial data was disclosed.

Verify contact through a previously known police or support route rather than replying to an unexpected approach. Do not circulate the recipient list, and ask the investigation team about available support or a safer contact address if the exposure creates a personal risk. Anyone considering a complaint can use the Met's official process and the ICO's public guidance.

A VPN can encrypt traffic between a device and the VPN server, which is useful on an untrusted local network. It cannot change the To, Cc or Bcc fields chosen by a sender, hide addresses from other recipients after delivery, or undo the sensitive association created by list membership.

This failure sits in communication design and governance. Safer defaults, controlled portals, small need-to-know groups, second-person checks and monitoring can reduce the chance of recurrence; a consumer VPN cannot substitute for those controls.

The changed angle is the timing and repetition. VPN Rocks covered the ICO's earlier Met Police enforcement action because it showed that disclosure mistakes were part of a wider control problem. A fresh visible-recipient error in another sensitive investigation makes implementation, not another promise to learn lessons, the central question.

For affected people, the practical risk is not limited to inbox privacy. An address plus the reason it appeared on this list can support targeted harassment or impersonation, so organisations should treat recipient metadata as sensitive data in its own right.