The data breach occurred Tuesday, when the Metropolitan Police sent a monthly update to victims but failed to hide -- or “blind cc” -- recipients’ email addresses, leaving them visible to others on the list.