The Department for Education (DfE) and a police database have fallen victim to a cyber-attack, resulting in the exposure of over 740,000 data entries.
Hackers have compromised information belonging to government officials, senior educational leaders, university personnel, law enforcement officers, and members of the public.
More than 600,000 entries were stolen from the DfE’s help-desk portal, revealing contact details for parents and staff members, including full names, email addresses, phone numbers, and job titles, as reported by a leak site created by the hackers.
A smaller set of comparable data was also acquired from the DfE’s Turing portal, which oversees a program for students studying internationally.
Additionally, the cyber-attack impacted the police national legal database (PNLD), which offers legal support to police forces in the UK. The hackers claimed to have extracted 135,000 data entries.
The PNLD confirmed that the stolen information includes the names of police officers and individuals involved in the criminal justice system, along with the force or organization they are affiliated with and their work email addresses.
Some information from members of the public who had previously interacted with the Ask the Police service was also compromised. However, the PNLD stated that the database does not contain sensitive information regarding victims, witnesses, or offenders.
While the breach of the police legal database is concerning, it is not considered to pose a significant threat.
A previously unidentified hacking group named ExfilSquad has claimed responsibility for the attack, releasing samples of the stolen data on their leak site, a tactic commonly employed by cybercriminals to solicit ransom for the compromised information.
The hackers are reportedly demanding a payment from both the DfE and PNLD to prevent the full extent of the data from being published, as indicated by screenshots reviewed by the Guardian.
According to the hackers, only a fraction of the data has been shared so far, but they threatened to release all of it if the DfE, PNLD, and other affected entities do not comply with their demands.
The group stated, “The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay.”
This warning appears to target 14 different victims of the hacking incident, including the DfE. One of the affected universities has been contacted by the Guardian for further information.
Cybersecurity firm Sophos, which provided the screenshots, mentioned that the data samples seem to be authentic. They also noted that an account on the social media platform X, allegedly belonging to the hackers, has been suspended, although it featured an image of a cybersecurity researcher who had previously been targeted by members of a larger hacking community.
Despite the breach, there is no evidence that ransomware, which typically locks users out of their systems, was utilized in this incident.
The Times, which initially reported the DfE breach, indicated that the compromised data includes information about government officials, senior educational leaders, and university staff, with the DfE overseeing early years, schools, and higher education in England.
The PNLD breach also included the theft of access passwords for the database.
A senior source familiar with the PNLD incident remarked, “The risk is low. The question is whether individuals use their PNLD passwords for more sensitive systems.”
The PNLD database, hosted by West Yorkshire Police, is accessible to law enforcement agencies across England and Wales.
The source added that it is still early in the investigation to fully understand the implications of the breach.
Any breach of the police national database or the police national computer would be considered far more severe. It is not believed that any sensitive information regarding officers in critical roles has been compromised.
The government is collaborating with the National Cyber Security Centre and the National Crime Agency to address the DfE breach. Both the DfE and PNLD have reported the incident to the Information Commissioner’s Office, the regulatory body overseeing data protection.
The DfE stated that “swift action” has been taken to mitigate the situation.
They clarified, “The information involved is limited to customer service contact details relating to individuals and organizations. No other data has been accessed.”
It has been indicated that the help-desk data comprises various sets of information that are not easily linked to one another.
