A hacking group calling itself ExfilSquad carried out a cyber-attack on systems belonging to the Department for Education (DfE) in England and the Police National Legal Database (PNLD). As a result, more than 740,000 records containing personal data were stolen.
From the Department for Education’s systems, the attackers took around 607,000 records. These include full names, job titles, email addresses and telephone numbers of government officials, school headteachers, university staff, as well as contact details of parents and employees who had contacted the support service. The DfE helpdesk portal and the Turing Scheme portal (which funds international education placements) were affected. According to the department, bank details, pupil data and other highly sensitive information were not compromised.
At the same time, the hackers breached the police PNLD database and stole approximately 135,000 records. These contained the names of police officers and criminal justice staff, the names of their forces or organisations, work email addresses, and passwords used to access the system.
The ExfilSquad group posted samples of the stolen data on a dark-web leak site and is demanding a ransom in exchange for not releasing the full dataset.
The Department for Education said the attack was contained quickly and that the risk to those affected is considered low, as the data consists of separate datasets that are difficult to link together. The department has reported the incident to the Information Commissioner’s Office (ICO) and is working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA). The affected portals have been temporarily taken offline and are expected to return to normal operation in the coming days.