The Department for Education (DfE) and a police database have been targeted by a cyber-attack, resulting in the exposure of more than 740,000 pieces of data. The stolen information includes details of government officials, senior school leaders, university staff, police officers, and members of the public.
Over 600,000 lines of data were taken from the DfE’s help-desk portal, revealing parent and staff contacts such as full names, email addresses, phone numbers, and job titles. A smaller amount of similar data was also stolen from the department's Turing portal, which manages a student abroad scheme.
Hackers also breached the police national legal database (PNLD), claiming to have taken 135,000 pieces of data. The PNLD stated that the stolen details relate to police officers and individuals working in criminal justice, including their names, organisations, and work email addresses. Some names and addresses of members of the public who used the Ask the Police service were also taken, though the database does not hold confidential victim, witness, or offender information.
A previously unknown hacking group, ExfilSquad, has claimed responsibility for the attack and posted data samples on a leak site. The group is demanding payment from the DfE and PNLD to prevent the release of all stolen data.
The government is collaborating with the National Cyber Security Centre and the National Crime Agency on the DfE hack. Both the DfE and PNLD have reported the incident to the Information Commissioner’s Office.