Loading story…
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group ExfilSquad, which alleged it stole more than 740,000 records and posted samples on a leak site. The Department for Education confirmed attackers accessed about 607,000 records through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly 135,000 records were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
PNLD confirmed that contact information for police, government, criminal justice, and customer-related individuals was compromised and published on the dark web. It said the exposed data included names, organizations, and work email addresses, notified affected organizations and Ask the Police users, and reported the incident to the ICO while working with the NCA and specialist cybersecurity organizations.
Analog Devices said it detected unauthorized access to certain systems on June 23, 2026. An investigation with outside security experts later found that hackers stole certain files, though the company did not disclose what types of information were compromised.
Analog Devices disclosed that hackers stole certain files from its systems but said the incident did not disrupt operations and was not expected to materially affect its business, operations, or financial condition. The company also said it was assessing public reports tied to ExfilSquad, which had claimed to have stolen 570,000 records from the firm in a separate and reportedly unrelated matter.
The Department for Education said it took swift action to contain the incident, began repairing both affected portals, and temporarily switched to telephone contact. It also said it was coordinating its response with the National Cyber Security Centre, the National Crime Agency, and the Information Commissioner's Office.
The UK Department for Education confirmed that attackers accessed more than 600,000 records through its Help Desk Self-Service Portal and Turing Scheme Portal. It said the exposed information included names, job titles, phone numbers, and contact details associated with head teachers, university staff, and government officials, and that the 607,000 figure referred to records rather than unique individuals.
A previously unknown group calling itself ExfilSquad claimed responsibility for stealing data from the UK Department for Education and the Police National Legal Database, allegedly taking more than 740,000 records in total and posting samples on a leak site. The DfE data allegedly included over 600,000 help-desk portal records and additional Turing portal data, while the PNLD data allegedly included about 135,000 records tied to police and criminal justice personnel and some public inquiry data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
grahamcluley.com
Open sourceitpro.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceitpro.com
Open sourcesecurityweek.com
Open sourcetheguardian.com
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 12, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
The UK Department for Education confirmed a cyber attack after a previously unknown group, **ExfilSquad**, claimed it had stolen about **607,000 records** from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a **data-theft-and-extortion** operation. The department said it had contained the incident and was working with the **National Cyber Security Centre** and **National Crime Agency** on the investigation. The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by **49% of primary schools**, **73% of secondary schools**, **88% of further education colleges**, and **98% of higher education institutions**. **Phishing** remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in **supply-chain security** and **patch management**, combined with budget and staffing constraints and rising concern over **AI-enabled social engineering**, continue to leave the sector exposed.
Aug 11, 2026