Hackers take more than 740,000 records from UK education and police systems

The Department for Education says no financial information was accessed, but stolen data includes contact details linked to parents, education staff, police officers and members of the public

Hackers obtained around 607,000 records from systems operated by the UK Department for Education

Hackers have taken data from the Department for Education in England and the Police National Legal Database, with the two breaches affecting more than 740,000 records and pieces of information.

Around 607,000 DfE records were obtained through attacks affecting its online help desk and the Turing Scheme portal, which supports a funding program for international education. The figure represents the number of records involved, not 607,000 separate people.

The compromised information includes names, telephone numbers, email addresses and job titles connected to individuals and organizations. Contacts reportedly include parents, government officials, senior school leaders and university staff.

The department says bank details were not obtained and describes the affected information as customer service contact data.

“We have robust processes in place to protect information and took swift action to contain this incident,” a DfE spokesperson says.

“The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed.”

Police and public contact details taken

A further 135,000 pieces of data were reportedly taken from the Police National Legal Database, which provides legal support to police forces across England and Wales and is hosted by West Yorkshire Police.

The PNLD says the information relates to “police officers and those working in criminal justice including their name, the force or organisation they work for and their work email address”.

Names and addresses belonging to some members of the public who previously contacted the Ask the Police service were also affected. The PNLD says its database does not contain confidential information about victims, witnesses or offenders.

Passwords used to access the PNLD site were reportedly among the data taken. However, the information is not believed to identify officers working in sensitive roles.

The incident does not involve the Police National Database or Police National Computer, which hold different police information.

ExfilSquad claims responsibility

A previously unknown hacking group calling itself ExfilSquad has claimed responsibility for the attacks and published samples on a data leak website.

The group reportedly demanded an unspecified payment from the DfE, PNLD and other alleged victims in return for not publishing the remaining information. Cybersecurity company Sophos assessed the samples and said they appeared to be legitimate.

There is no evidence that ransomware, malicious software used to lock an organization’s systems, was deployed against the DfE.

The department is working with the National Cyber Security Centre and National Crime Agency to establish the circumstances and impact of the incident.

An NCA spokesperson states: “We are aware of an incident affecting the Department for Education and are working with partners to understand the circumstances and impact.”

Both the DfE and PNLD have reported the breaches to the Information Commissioner’s Office. The affected DfE help desk and Turing Scheme services are expected to return to normal operation later this week.