UK Department for Education cyberattack leaks 607,000 records
Hackers breached the UK Department for Education (DfE), exfiltrating more than 607,000 records. The stolen data consists of telephone numbers, email addresses, names, job titles and other contact details of head teachers, university staff, government officials and other individuals, but does not include banking or other highly sensitive information.
The attack compromised the DfE’s Help‑Desk Self‑Service portal and the Turing Scheme portal that funds international study. A previously unknown group calling itself ExfilSquad claimed responsibility and posted samples on a leak site. The DfE has referred the incident to the Information Commissioner’s Office and is cooperating with the National Cyber Security Centre and the National Crime Agency. Officials say the risk to individuals is low because the data are limited to customer‑service contact details and cannot be linked across datasets.
A separate breach affected the Police National Legal Database, with about 135,000 records of police and legal staff reportedly taken. Both affected DfE services have been taken offline for repairs and are expected to be fully restored by the end of the week.
Entities: Department for Education (UK) · ExfilSquad · Information Commissioner’s Office · National Crime Agency · National Cyber Security Centre · UK Department for Education
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 8 SOURCES] Hackers stole over 607,000 records from the UK Department for Education. (multiple sources)
- [● 3 SOURCES] The breach affected the DfE’s Help‑Desk Self‑Service portal and the Turing Scheme portal. (multiple sources)
- [● 4 SOURCES] Risk to individuals was assessed as low because the data were limited to customer‑service contact details. (multiple sources)
- [● 3 SOURCES] Both affected DfE services are expected to be fully restored by the end of the week. (multiple sources)
- [● 3 SOURCES] A hacking group called ExfilSquad claimed responsibility for the attack. (multiple sources)
- [● 4 SOURCES] The stolen data included telephone numbers and email addresses of individuals and organisations. (multiple sources)
- [● 4 SOURCES] The DfE referred the breach to the Information Commissioner’s Office and is working with the NCSC and NCA. (multiple sources)
- [● 2 SOURCES] The Police National Legal Database was also breached, with about 135,000 records taken. (multiple sources)