Loading story…
The extortion group ExfilSquad claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the Ask the Police service. The group said it stole 1.9GB of data covering roughly 135,000 records, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the UK National Crime Agency were involved in the investigation and response.
The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including Microsoft Dataverse, Power Pages, case management systems, and CRM environments. Researchers said the group recently named 13 additional victims across the United States, United Kingdom, and Sweden, and has shifted to torrent-based distribution of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in China and Russia to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Resecurity reported that on August 7, 2026, torrent-sharing nodes and seeds in China and Russia were among the most active distributing ExfilSquad-linked leaked data, suggesting strong interest or possible prior awareness of the release.
ExfilSquad set August 5, 2026 as the deadline for negotiations with newly listed victims before releasing stolen data.
In a statement dated August 3, PNLD disclosed that police officers, staff, criminal justice professionals, government partners, customers, and some Ask the Police users had data compromised, while saying there was no evidence passwords or other credentials were affected.
The Police National Legal Database said it identified a data security incident on July 26 affecting names, organizations, and work email addresses, with some data later appearing on the dark web.
Reporting said ExfilSquad targeted a major financial institution in Nigeria in July 2026 as part of its expanding victim set.
Security reporting described ExfilSquad as emerging in mid-2026 and operating by stealing data from cloud and SaaS platforms, then threatening publication rather than deploying ransomware.
During the reported week, ExfilSquad announced 13 new victim organizations in the United States, the United Kingdom, and Sweden, reflecting an expansion of its extortion campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
Personal data for more than **100,000 UK police officers and staff** was reportedly leaked on the dark web after a major breach affecting multiple government bodies. Exposed information included **full names and contact details**, with reporting indicating the incident also impacted the **Ministry of Defence**, **Home Office**, **National Crime Agency**, and **Crown Prosecution Service**, adding to concerns over the exposure of sensitive law-enforcement and government personnel records. The intrusion has been attributed in reporting to the cybercriminal group **ExfilSquad**, which allegedly listed the victims on its leak site and claimed the access stemmed from **Microsoft Power Apps** and **Dynamics 365** misconfigurations. Specifically, the group said improperly configured permissions on **Dataverse** tables enabled the data exposure, and the breach was reported after a separate recent compromise involving the **Department for Education**.
Aug 4, 2026
Dark web monitoring reports described **unverified data leak claims** involving several organizations, including French parcel delivery firm **Colis Privé**. One post on **BreachForums** allegedly offered an upload of **22,564,381 records** attributed to Colis Privé, described as `.jsonl` files totaling **~4.1 GB**; no specific threat actor attribution or company confirmation was cited, and the notice characterized the situation as informational while scope is assessed. If authentic, the scale and format of the dataset would materially increase risk of **identity theft, credential stuffing, and targeted phishing** against customers. Separate dark web forum posts also alleged database exposures affecting **JobsGO** (Vietnam recruitment platform), **MyVete** (veterinary management platform), **PIXPAY** (Senegalese payment service), and **Groupe Fondasol** (France-based engineering). The claimed datasets reportedly include **CV/personal records**, and in some cases **API credentials and employee metadata**, with example figures including **~2.3 million records** for JobsGO and **~5.57 million records** for MyVete (verification not indicated). Across the claims, the primary business risk is downstream abuse of exposed personal and operational data for **social engineering, recruitment fraud, and account takeover**, rather than immediate exploitation of a specific software vulnerability.
Jun 29, 2026