Cyber-Attack Exposes Data from UK Department for Education and Police Legal Database

London (GNP): The UK Department for Education and a police legal database have both been targeted in a cyber-attack that has exposed more than 740,000 records, affecting government officials, senior school leaders, university staff, police officers and members of the public. The breach has raised fresh concerns about the security of sensitive administrative systems used across government and law enforcement, with details continuing to emerge about the scale and nature of the stolen information.

The largest portion of the breach involves just over 600,000 lines of data taken from the Department for Education’s help-desk portal, which included parent and staff contact details such as full names, email addresses, phone numbers and job titles. According to a leak site established by the attackers, a smaller set of similar data was also taken from the department’s Turing portal, which administers a scheme supporting students studying abroad, suggesting the intrusion extended across more than one system within the department.

Alongside the Department for Education breach, hackers also gained access to the Police National Legal Database, a system that provides legal guidance to police forces across the country, with the attackers claiming to have taken around 135,000 pieces of data.

The database’s operators confirmed that the stolen information related to police officers and criminal justice personnel, including names, employing organizations and work email addresses, and that a limited number of names and addresses belonging to members of the public who had submitted queries through the Ask the Police service were also affected. Officials were clear, however, that no confidential victim, witness, or offender information was stored in the system, and the breach is not currently regarded as serious.

An unfamiliar hacking group calling itself ExfilSquad has claimed responsibility for the attack, publishing sample data on a dedicated leak site as part of an approach commonly used by cybercriminals to pressure victims into paying for the return or suppression of stolen material.

According to screenshots reviewed by the Guardian, the group is demanding payment from both the Department for Education and the Police National Legal Database in exchange for withholding the remainder of the data, warning that only a small portion has been released so far and that the full dataset would be published if payment is not made. The message reportedly named fourteen separate organisations as victims, including a UK university that has since been contacted for comment.

Cybersecurity firm Sophos, which supplied the screenshots used to verify the claims, said the samples of stolen data appeared genuine, while noting that an account on the social media platform X believed to belong to the group had since been suspended.

Also Read: Pakistan built a strong foundation for digital growth, Julian

The account, Sophos said, had used an image of a cybersecurity researcher previously targeted by members of “the Com,” a loosely organised network of English-speaking hackers. Despite the scale of the breach, it is understood that no evidence has emerged suggesting ransomware, malicious software used to lock victims out of their own systems, was deployed during the attack on the Department for Education.

Separately, the breach of the police legal database included the theft of passwords used to access the system, prompting concern less about the database itself and more about whether affected individuals had reused those credentials on more sensitive platforms. A senior source familiar with the incident described the overall risk as low, while cautioning that it remains early in the process of understanding the full extent of what occurred.

The database, hosted by West Yorkshire Police, is used by police forces throughout England and Wales, though officials noted that a breach of either of the two more sensitive national police databases would have represented a considerably more serious incident, and there is no indication that information about officers in sensitive postings could be identified from the leaked material.

The government confirmed it is working closely with the National Cyber Security Centre and the National Crime Agency to investigate the Department for Education hack, and that both affected organisations have reported the incident to the Information Commissioner’s Office.

In a statement, the Department for Education said swift action had been taken to contain the breach, emphasising that the exposed information was limited to customer service contact details and that no other data had been accessed. It is also understood that the stolen help-desk data is split across multiple sets that cannot easily be linked to one another, a factor officials suggest may limit the practical risk to those affected.