Loading story…
The UK Department for Education confirmed a cyber attack after a previously unknown group, ExfilSquad, claimed it had stolen about 607,000 records from the department’s Help Desk Self-Service Portal and Turing Scheme Portal. The exposed data reportedly included names, email addresses, telephone numbers, and job titles linked to parents, school leaders, university staff, and government officials. The attackers allegedly sought to extort the department by threatening to publish the data rather than encrypt systems, indicating a data-theft-and-extortion operation. The department said it had contained the incident and was working with the National Cyber Security Centre and National Crime Agency on the investigation.
The breach lands amid persistent cyber pressure across UK education, where the government’s 2025/2026 breaches survey found incidents were identified by 49% of primary schools, 73% of secondary schools, 88% of further education colleges, and 98% of higher education institutions. Phishing remained the most common threat, while further and higher education institutions reported broader exposure to impersonation, malware, denial-of-service, and unauthorized access, along with greater operational impact. The survey said education institutions generally maintain stronger governance and technical controls than businesses, but weaknesses in supply-chain security and patch management, combined with budget and staffing constraints and rising concern over AI-enabled social engineering, continue to leave the sector exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In late July, the UK Department for Education confirmed a cyber attack affecting its Help Desk Self-Service Portal and Turing Scheme Portal. The department said it had taken action to contain the incident and was working with the National Cyber Security Centre and National Crime Agency on the investigation.
The Department for Science, Innovation and Technology and the Home Office published the 2025/2026 Cyber Security Breaches Survey education annex. It reported high breach-identification rates across education institutions, with phishing the dominant threat and further/higher education seeing more frequent and severe impacts.
The quantitative survey and qualitative interviews for the UK Cyber Security Breaches Survey 2025/2026 education annex were conducted between August and December 2025. The research covered state educational institutions including primary and secondary schools, further education colleges, and higher education institutions.
A previously unknown cybercrime group calling itself ExfilSquad claimed responsibility for the Department for Education breach. The group reportedly stole about 607,000 records and attempted to extort the department by threatening to publish the data rather than encrypting systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
French education authorities disclosed two significant breaches affecting both public and Catholic school administration systems. The Ministry of National Education said its `Compass` platform, used to manage trainee teachers in primary and secondary education, was compromised after a user reportedly opened a fraudulent email attachment and had credentials stolen. The incident exposed data on about **243,000 people**, including identity and contact details, absence periods, and the identities and professional phone numbers of tutors, though the ministry said no health data was involved. ANSSI was brought in, a crisis cell was opened, and the ministry announced a security plan centered on **multi-factor authentication**, stronger data segmentation, and reduced application exposure. Separately, the Secrétariat général de l’enseignement catholique reported a cyberattack on its management application for nursery and elementary schools that affected about **1.5 million people**. Unauthorized access exposed identification data for application users and contact information for students, families, and teachers, including names, postal and email addresses, phone numbers, and dates of birth, increasing the risk of phishing. The organization said it secured access, suspended affected services, notified authorities including the French Ministry of Education, and engaged specialist responders, while a forum user calling themselves **"Ryolait"** allegedly offered the stolen database for sale starting at **$2,000**. The incidents add to mounting concern over weak security in the education sector, which ANSSI has described as a frequent target of opportunistic attacks.
Jun 29, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026