2026 UK Department for Education — confirmed ~607,000 contact records (ExfilSquad)
Data compromised
Per The Times / sources: ~607,000 records including full names, job titles, telephone numbers, and email addresses of people who engaged with DfE (head teachers, university staff, government officials, organisations). DfE: limited to customer-service contact details; no other data accessed.
Technical writeup
Verified government disclosure — Department for Education confirmed a data-security incident exposing more than 600,000 records (BBC / Computing / SC World / The Register citing DfE). Sources and later reporting put the haul at about 607,000 customer-service contact records from the Customer Help Portal and Turing Scheme (names, job titles, phones, emails of head teachers, university staff, officials, and organisations). DfE help article updated 3 Aug 2026: compromised information limited to those contact details; no other departmental data accessed. Dark-web posts attributed the theft to ExfilSquad (same crew later linked to PNLD). DfE contained the incident, took services offline, referred itself to the ICO, and worked with NCSC and NCA. BreachHistory indexes recordsAffected 607000.
Root cause
Unauthorized access to DfE help-desk systems and Turing Scheme records; ExfilSquad claimed responsibility via dark-web posts (attribution not independently proven in public forensic detail)
References
- https://www.thetimes.com/uk/technology-uk/article/headteachers-in-major-dfe-hacking-breach-mrphvtl9s
- https://www.gov.uk/government/organisations/department-for-education
- https://www.gov.uk/government/news/new-digital-id-scheme-to-be-rolled-out-across-uk
- https://www.bbc.com/news/articles/c5y930x81wpo
- https://www.bbc.co.uk/news/articles/cq6dmgrp21po
- https://www.scworld.com/brief/uk-department-for-education-confirms-data-breach-affecting-over-600000-records
- https://customerhelp.education.gov.uk/hc/en-gb/articles/37603058079122-Data-security-incident-information-Updated-030826-08-45
- https://www.theregister.com/cyber-crime/2026/08/03/police-national-legal-database-confirms-data-theft-after-dark-web-leak/5282332