-
Hackers broke into two UK Department for Education systems and stole around 607,000 records.
-
The stolen data includes names, job titles, emails, and phone numbers of school leaders and officials.
-
Officials call the risk low, but critics call it the department’s second major breach in three years.
The UK’s Department for Education (DfE) has suffered a large data breach. Attackers broke into two of the department’s online systems. The breach exposed personal details of school leaders, university staff, and government officials.
According to The Times, which broke the story first, a group called ExfilSquad claims responsibility. The group reportedly posted the stolen data on the dark web afterward.
Two Systems Hit – What Happened
The attackers targeted two systems. One was the DfE’s Help Desk Self Service Portal. The other was the Turing Scheme Portal, which manages funding for students studying or working abroad.
The breach follows a similar pattern of attacks on educational data. The Canvas learning management platform’s parent company, Instructure, recently confirmed it paid a ransom to prevent the leak of student information after a ransomware gang breached its network.
The DfE confirmed that hackers took about 607,000 records. The department explained that this number counts individual data lines, not people. One person’s information can appear in more than one record.
Even so, according to The Times, security experts see this as one of the biggest UK public sector breaches this year.
Sensitive Credentials Blown Open Amid Data Breach
The leaked data reportedly includes full names, job titles, work emails, and phone numbers. This information belonged to people who had contacted the department before.
Headteachers, senior school staff, university workers, and government officials are among those affected, according to Schools Week. No financial information appears to have been taken. The DfE took both portals offline right after the breach.
Staff switched to phone support while engineers fixed security gaps, which is confirmed by TorWire security experts. The department has not said when the portals will return.
Response and What It Means
A DfE spokesperson said the department has strong systems in place to protect information, and acted fast to contain the breach, according to Tes. The DfE reported itself to the Information Commissioner’s Office (ICO).
It is now working with the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC). The NCA confirmed it is working with partner groups to understand what happened, per the Local Government Lawyer.
The department said the risk to affected people is not high. Officials argue that the leaked datasets cannot easily be matched together. When asked if affected school leaders were told about the breach, the DfE gave no comment.
This explanation has drawn sharp criticism. Liberal Democrat education spokesperson Munira Wilson called it the department’s second alarming breach in under three years, according to Intelligent CISO. She pushed the DfE to reveal what data was taken, who faces risk, and what steps people should take.
Her comment points back to an earlier incident. About a year ago, the DfE reported five data breaches to the ICO. Those breaches may have affected more than 84,500 people, per IT Security expert.
Security experts warn that stolen contact details still hold real value for scammers, even without financial data attached. The records include real names, job titles, and direct contact information. Attackers could use these details to craft convincing phishing emails.
Schools, academy trusts, universities, and local councils could all become targets. Experts advise treating unexpected messages with caution. They recommend checking requests through a separate channel and turning on multi-factor authentication where possible.
This breach also raises fresh concerns about outside systems and suppliers linked to government networks. Analysts say protecting service desks and support tools ahead of time works better than fixing problems after an attack happens.
