Hackers Target UK Education Department and Police Database, Exposing More Than 740,000 Records

A cybercriminal group has claimed responsibility for attacks targeting the UK Department for Education (DfE) and the Police National Legal Database (PNLD), resulting in the theft of hundreds of thousands of records containing personal and professional information.

More than 740,000 data entries are believed to have been stolen from the two systems, including details belonging to government officials, school leaders, university employees, police personnel, and members of the public.

Education Department Data Breach

The largest portion of the stolen information came from the Department for Education’s help-desk portal, where hackers allegedly accessed more than 600,000 records.

The exposed information reportedly includes:

• Full names
• Email addresses
• Phone numbers
• Job titles
• Contact details of parents and education staff

Hackers also claimed to have accessed data from the DfE’s Turing portal, which manages a student overseas study program. A sample of the stolen information was published on a leak website operated by the attackers.

Police Legal Database Also Compromised

The attackers also targeted the Police National Legal Database (PNLD), a system used by police forces across England and Wales for legal guidance.

The hackers claimed to have stolen around 135,000 records from the database. The exposed information reportedly includes:

• Police officers’ names
• Police force or organisation details
• Work email addresses
• Information from some members of the public who contacted the Ask the Police service

Authorities said the database does not contain confidential information about crime victims, witnesses, or offenders.

While the incident has raised concerns, officials said the breach is not considered as serious as an attack involving major police databases such as the Police National Computer or Police National Database.

ExfilSquad Claims Responsibility

A previously unknown hacking group calling itself ExfilSquad claimed it carried out the attacks and published samples of the stolen information online.

The group appears to be following a common cybercrime tactic: releasing limited samples of stolen data to pressure victims into paying ransom demands.

Messages posted by the attackers reportedly demanded payment from the affected organisations, threatening to release the full datasets if their demands were not met.

Cybersecurity company Sophos reviewed the leaked samples and said the data appeared to be authentic. The company also noted that an online account linked to the group was suspended after appearing to use the image of a cybersecurity researcher who had previously been targeted by online hackers.

No Evidence of Ransomware Attack

Although the attackers stole data, there is currently no indication that ransomware was deployed against the Department for Education or PNLD systems.

Ransomware attacks typically involve criminals locking an organisation’s systems and demanding payment to restore access. In this case, the attackers appear focused on data theft and extortion.

The PNLD breach reportedly included stolen passwords used to access the website. Security officials warned users who reused those passwords on other systems that they could face additional risks.

Government Investigating the Incident

The UK government said it is working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) to investigate the DfE breach.

Both the Department for Education and PNLD have reported the incidents to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

The Department for Education said it took immediate action to contain the incident and stressed that the exposed information was limited to customer service contact details.

Officials said no other data had been accessed, and investigations are continuing to determine the full scope of the attacks.

The breach highlights the growing threat posed by cybercriminal groups targeting government institutions and public-sector databases containing large amounts of personal information.