UK government data breaches by ExfilSquad

In late July 2026, the UK Department for Education suffered a cyber‑attack that exposed more than 607,000 records, including contact details of head teachers, university staff and government officials. The breach also affected the Police National Legal Database, compromising about 135,000 records of police and legal personnel. The hacker group calling itself ExfilSquad claimed responsibility and posted sample data, prompting the DfE to work with the National Cyber Security Centre and the National Crime Agency.

A few days later, on 2 August 2026, UK Government Investments disclosed that an internal file containing the names and work email addresses of 51 senior officials had been left publicly accessible for roughly 40 hours due to a staff‑member error. The agency engaged external experts to tighten its security. The same ExfilSquad group reiterated its claims of breaching the Department for Education and the police legal database, confirming the earlier leaks. Both incidents highlight a wave of cyber‑attacks targeting multiple UK government bodies and the ongoing response by security authorities.