2026 UK Department for Education — help desk/Turing Scheme breach; ~607,000 contact records (ExfilSquad claim)
Data compromised
Per The Times / sources: ~607,000 records including full names, job titles, telephone numbers, and email addresses of people who engaged with DfE (head teachers, university staff, government officials, organisations). DfE: limited to customer-service contact details; no other data accessed.
Technical writeup
Verified government disclosure — reported July 29, 2026 by The Times with a Department for Education statement. Sources told The Times about 607,000 records were taken in an attack understood to have occurred the prior week. The intrusion targeted the department’s help desk (used by school leaders and local authorities) and records tied to the Turing Scheme, which education institutes use to track British students studying abroad. Dark-web posts attributed the theft to a group calling itself ExfilSquad; compromised fields reportedly include full names, job titles, telephone numbers, and email addresses of people who engaged with the department. The Times reviewed head-teacher names and email addresses among data available on the dark web. DfE said it took swift action to contain the incident, took affected services offline, referred itself to the Information Commissioner, and is working with the National Cyber Security Centre and National Crime Agency. Official statement: information involved is limited to customer-service contact details relating to individuals and organisations, and no other data was accessed. BreachHistory indexes recordsAffected 607000 from Times-cited sources alongside DfE’s confirmed contact-detail scope.
Root cause
Unauthorized access to DfE help-desk systems and Turing Scheme records; ExfilSquad claimed responsibility via dark-web posts (attribution not independently proven in public forensic detail)