DfE confirms cyber attack exposed 607,000 records

Names, emails and phone numbers taken from helpdesk and Turing Scheme systems

The Department for Education (DfE) has confirmed that around 607,000 records were breached in a cyberattack.

The BBC reported that hackers obtained approximately 607,000 records relating to the department's helpdesk and the Turing Scheme an international education funding programme.

The attackers are reported to be associated with a little-known cybercrime group calling itself ExfilSquad.

The DfE says it is working with the Information Commissioner's Office (ICO), the National Cyber Security Centre (NCSC) and National Crime Agency (NCA) to investigate the incident. A spokesperson said: "We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed."

The Department has not named a suspect, but The Times said it had seen the names and email addresses of head teachers, university staff and government officials supposedly stolen by ExfilSquad.

On a leak site the group says it stole around 600,000 records from the help portal and a further 7,000 from the Turing Portal, with records containing full names, email addresses, phone numbers and job titles.

However, these claims have not been independently verified, and currently there is no public evidence linking ExfilSquad to the attack beyond the group's own statements. Neither is there much information available about the origins of the group, its methods or tools.

Trevor Dearing, director of critical infrastructure at security vendor Illumio, expressed surprise that, after repeated public sector breaches, attackers can still gain access to such large volumes of sensitive data.

"That suggests many organisations remain too reliant on keeping attackers out rather than limiting what they can reach once they're in. By the time data appears on the dark web, attackers have already achieved their objective. The real question is why they were able to reach so much sensitive information in the first place."