UK government agencies hit by data breaches exposing officials' details

UK Government Investments (UKGI), the public body that manages the state's holdings in companies such as Channel 4 and the Post Office, disclosed a security failure that left an internal file containing high‑level management information and the names and work email addresses of 51 government officials publicly accessible for about 40 hours. The breach was attributed to a staff member who did not follow information‑security policies, prompting the agency to hire external experts and strengthen its controls.

Separately, the hacker group ExfilSquad claimed to have breached the UK Department for Education and the Police National Legal Database. The group said it obtained 607,000 personal records from the department’s two portals and 135,000 records from the police legal database, including names, email addresses, phone numbers and job titles of students, parents, officials and police staff. The Department for Education confirmed the attack and is working with the National Cyber Security Centre and the National Crime Agency, while Sophos verified the leaked data as likely authentic.