Hackers Claim Data Theft from UK Education and Police

A previously unknown hacking collective, ExfilSquad, has claimed responsibility for cyber-attacks against the UK's Department for Education (DfE) and a police database. The group alleges it has stolen more than 740,000 pieces of data in total. ExfilSquad has posted samples of the compromised information on a leak site, a common tactic used by cybercriminals to solicit payment.

Data Compromised

Read Next in Barnet Press3 min read

Islington Covid Positivity Rate Falls After Initial Spike

Council attributes initial high figures to low testing volumes, not a borough-wide surge.

According to ExfilSquad's claims, the DfE's help-desk portal had approximately 600,000 lines of data extracted. This data reportedly includes full names, email addresses, and phone numbers belonging to parents and staff. A smaller quantity of similar data was also allegedly taken from the department's Turing portal, which manages a scheme for students studying abroad.

The hackers also claim to have breached the Police National Legal Database (PNLD), a resource used by UK police forces for legal assistance. ExfilSquad stated that 135,000 pieces of data were taken from the PNLD. This information is understood to include the names, employing organisations, and work email addresses of police officers and criminal justice personnel. Some names and addresses of members of the public who had previously used the 'Ask the Police' service were also reportedly accessed.

Demands and Official Statements

Related Borough Coverage4 min read

TfL under‑investment leaves commuters losing 830,000 hours in April‑May 2026

A £6.5 billion renewals backlog and spending below the required level have driven delays that affect Barnet residents and the wider capital

ExfilSquad is demanding an unspecified payment from both the DfE and the PNLD. The group has indicated that all stolen data will be uploaded if the requested payment is not made. Screen grabs of messages seen by The Guardian suggest the hackers view the payment as a minor cost compared to potential litigation expenses if the data is released.

The Department for Education has stated that the information accessed was limited to customer service contact details for individuals and organisations. The DfE has asserted that no other data was breached. Similarly, the PNLD has confirmed that the hack did not involve confidential information relating to victims, witnesses, or offenders.

Cybersecurity company Sophos, which reviewed screenshots of the data samples posted by the hackers, indicated that the samples appeared legitimate. The PNLD has also reported that passwords used to access the site were among the stolen data, raising concerns about potential reuse on other systems.

Next Steps

The DfE and the PNLD have reported the incidents to the Information Commissioner's Office, the UK's data protection regulator. The government has stated it is collaborating with the National Cyber Security Centre and the National Crime Agency to investigate the DfE hack. It remains unclear if ransomware was deployed in the attacks.