Hackers steal 740,000 records from DfE and police database

Hackers stole more than 740,000 pieces of sensitive data from the Department for Education and a police database on July 29, 2026. The breach exposed contact details of parents, staff, government officials, senior school leaders, university staff, police officers, and members of the public.

The Department for Education lost over 600,000 lines of data from its help-desk portal, including full names, email addresses, phone numbers, and job titles. A smaller set of similar data was taken from the department’s Turing portal, which manages a study-abroad scheme. The police national legal database, which provides legal assistance to UK forces, had 135,000 pieces of data stolen, affecting police officers, criminal justice workers, and some members of the public who had used the Ask the Police service.

The breach is significant because it compromises personal information that could be used for phishing or fraud, though the police database did not hold confidential victim, witness, or offender information. The Department for Education said the data was limited to customer service contact details and that no other information was accessed.

A previously unknown hacking gang calling itself ExfilSquad claimed responsibility and posted samples on a leak site, according to screenshots seen by the Guardian. The group demanded an unspecified payment from 14 alleged victims, including the DfE and a UK university, threatening to release all data otherwise. Sophos, a cybersecurity company, said the data samples appeared legitimate and noted that an X account apparently linked to the group had been suspended but featured a picture of a researcher previously targeted by the Com, a network of English-speaking hackers.

The police national legal database breach included stolen passwords, raising concerns about password reuse on more sensitive systems. One senior source briefed on the leak said the risk was low but questioned whether users employed the same credentials elsewhere. The database is hosted by West Yorkshire police and is accessible to forces across England and Wales.

The government is working with the National Cyber Security Centre and the National Crime Agency on the DfE hack, and both the DfE and PNLD have reported the incident to the Information Commissioner’s Office. The DfE said swift action was taken to contain the incident, and it is understood that the help-desk data consists of separate sets that cannot be easily connected.