breach-disclosure-notificationunderground-data-leakmass-credential-exposureeducation-sector-threat

ExfilSquad Claims UK Education and Police Data Theft Amid Extortion Campaign

Breach & Incident Intelligence · 15 sources · Updated 3mo ago · First seen Jun 23, 2026

The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group ExfilSquad, which alleged it stole more than 740,000 records and posted samples on a leak site. The Department for Education confirmed attackers accessed about 607,000 records through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly 135,000 records were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.

Is this vendor in your chain?See attribution, scope, and your downstream exposure.

Check the blast radius

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

6 events · Jun 23, 2026 – Jul 26, 2026

Reported Jul 30, 20263mo ago
Department for Education confirms portal data was accessed
The UK Department for Education confirmed that attackers accessed more than 600,000 records through its Help Desk Self-Service Portal and Turing Scheme Portal. It said the exposed information included names, job titles, phone numbers, and contact details associated with head teachers, university staff, and government officials, and that the 607,000 figure referred to records rather than unique individuals.
Head teacher data accessed in Department for Education cyber attack | IT Pro
Reported Jul 30, 20263mo ago
Analog Devices discloses breach and reviews ExfilSquad claim
Analog Devices disclosed that hackers stole certain files from its systems but said the incident did not disrupt operations and was not expected to materially affect its business, operations, or financial condition. The company also said it was assessing public reports tied to ExfilSquad, which had claimed to have stolen 570,000 records from the firm in a separate and reportedly unrelated matter.
Semiconductor Firm Analog Devices Discloses Data Breach - SecurityWeek
Reported Jul 29, 20263mo ago
DfE begins containment and coordinates with UK authorities
The Department for Education said it took swift action to contain the incident, began repairing both affected portals, and temporarily switched to telephone contact. It also said it was coordinating its response with the National Cyber Security Centre, the National Crime Agency, and the Information Commissioner's Office.
Hackers steal sensitive data from UK Department for Education and police | Cybercrime | The Guardian
Reported Jul 29, 20263mo ago
ExfilSquad claims theft of UK education and police data
A previously unknown group calling itself ExfilSquad claimed responsibility for stealing data from the UK Department for Education and the Police National Legal Database, allegedly taking more than 740,000 records in total and posting samples on a leak site. The DfE data allegedly included over 600,000 help-desk portal records and additional Turing portal data, while the PNLD data allegedly included about 135,000 records tied to police and criminal justice personnel and some public inquiry data.
Hackers steal sensitive data from UK Department for Education and police | Cybercrime | The Guardian
Jul 26, 20264mo ago
PNLD confirms breach of police and government contact data
PNLD confirmed that contact information for police, government, criminal justice, and customer-related individuals was compromised and published on the dark web. It said the exposed data included names, organizations, and work email addresses, notified affected organizations and Ask the Police users, and reported the incident to the ICO while working with the NCA and specialist cybersecurity organizations.
PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web
Jun 23, 20265mo ago
Analog Devices detects unauthorized access to systems
Analog Devices said it detected unauthorized access to certain systems on June 23, 2026. An investigation with outside security experts later found that hackers stole certain files, though the company did not disclose what types of information were compromised.
Semiconductor Firm Analog Devices Discloses Data Breach - SecurityWeek

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

ExfilSquad

Organizations

2 linked

Police National Legal DatabaseDepartment for Education

Breaches

3 linked

DEPARTMENTFOREDUCATION-2026-05UKDEPARTMENTFOREDUCATION-2026-07POLICENATIONALLEGALDATABASE-2026-08

Do you run this?See attribution, scope, and whether this vendor sits anywhere in your supply chain.

Get the Full Incident Picture

Source coverage

Sources

15 references tracked. Mallory keeps watching after this page renders.

GrahamcluleyNews · Aug 5, 2026

Smashing Security podcast #479: How a fake police officer nearly stole Graham’s cryptocurrency • Graham CluleyOpen source ↗

ItproNews · Aug 4, 2026

Police National Legal Database confirms data leaked on the dark web | IT ProOpen source ↗

Security AffairsNews · Aug 3, 2026

PNLD Confirms Data Breach Affecting UK Police and Justice StaffOpen source ↗

The Hacker NewsNews · Aug 3, 2026

PNLD Breach Exposes U.K. Police and Government Contact Details on Dark WebOpen source ↗

7 additional sources from 30-07-2026 to 01-08-2026

ItproNews · Jul 30, 2026

Head teacher data accessed in Department for Education cyber attack | IT ProOpen source ↗

Security WeekNews · Jul 30, 2026

Semiconductor Firm Analog Devices Discloses Data Breach - SecurityWeekOpen source ↗

TheguardianNews · Jul 29, 2026

Hackers steal sensitive data from UK Department for Education and police | Cybercrime | The GuardianOpen source ↗

Ncsc BlogNews · Jan 28, 2021

Data breach guidance for individualsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News