The scale of the breach
More than 740,000 data records were compromised in a coordinated cyber-attack that targeted both the UK Department for Education and a national police database. Around 600,000 data entries were taken from the DfE’s help-desk portal, containing contact details such as full names, phone numbers, job titles and email addresses of individuals. This data is said to include both parents and staff within the education sector. A second breach involved the Turing portal, which is used to manage information about students studying abroad, though the exact number of data points taken from this system is not specified.
In a separate but related incident, the police national legal database (PNLD) was also infiltrated, with approximately 135,000 records accessed. The data includes personal information of police officers and other criminal justice professionals, such as their full names, affiliated organizations and work email addresses. The breach also exposed the names and addresses of members of the public who had previously submitted questions via the Ask the Police service. However, officials have confirmed that no confidential data related to victims, witnesses or offenders was compromised.
The ransom demand
The cybercriminals, identifying themselves as a hacking group called ExfilSquad, have issued a ransom demand to the DfE and the police authorities, offering to withhold the full data release in exchange for an unspecified payment. Samples of the stolen data have already been posted online, and the hackers claim that all of it will be published unless a payment is made. The message sent to victims states that the amount requested is far less than the potential legal costs they might face due to the breach. 'The cost we ask is minimal compared to your legal expenses from this leak. Just pay up and be smart,' the hackers reportedly said.
The group is reportedly targeting 14 organizations, including the DfE and at least one UK university that has been contacted about the breach by the Guardian. Although the language used by the hackers resembles the tactics of typical ransomware attackers, there is no evidence yet that a malicious file was deployed to lock down any systems during this incident.
Government and law enforcement response
The Department for Education and the police have both reported the breach to the Information Commissioner’s Office, the regulatory body that oversees data protection. The DfE has stated that it has taken swift action to contain the attack and prevent further damage. It claims the stolen data is limited to contact details and that no deeper or more sensitive information has been accessed. The department also emphasized that the data from the help-desk portal includes separate sets of information that are not easily cross-referenced.
A source close to the PNLD investigation has described the level of risk as low, though they warned that the concern lies in whether individuals reuse their PNLD passwords for other platforms. The legal database, which is maintained by West Yorkshire Police, is accessible to all police forces across England and Wales. Officials have said that investigations are still in early stages and that a clearer picture of the breach will emerge as more information is uncovered.
The breach is not thought to reveal specific information about officers in sensitive positions or roles. Authorities have also clarified that any potential impact would be more severe if other police databases, such as the police national database or the police national computer, had been similarly compromised. The government has said it is working closely with the National Cyber Security Centre and the National Crime Agency to address the DfE cyberattack and support ongoing investigations.