The Department for Education (DfE) is investigating a cyberattack after hackers stole around 607,000 records containing the professional contact details of school leaders, university staff and government officials.
The attack targeted the department's online customer help desk and the Turing Scheme portal, which supports the UK's international study placement programme.
The stolen records include names, job titles, work email addresses and telephone numbers belonging to individuals and organisations that had contacted the department.
The DfE said the information has been published online by a cybercriminal group calling itself ExfilSquad.
It has referred the incident to the Information Commissioner's Office (ICO) and is working with the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) while investigations continue.
What Information Was Compromised?
The department said the compromised information was limited to professional contact details and did not include bank details, passwords or other sensitive personal information.
Officials added that the overall risk to individuals was considered low because the different datasets could not easily be linked into complete personal profiles.
The hackers targeted the DfE's online customer help desk, which handles enquiries from school leaders and local authorities, and the Turing Scheme portal used to administer overseas placements for UK students. Both services were temporarily switched to telephone support while engineers carried out security work, with normal operations expected to resume later this week.
A DfE spokesperson said the department took swift action to contain the incident and that no other data had been accessed. An NCA spokesperson confirmed the agency was working with partner organisations to understand the circumstances and impact of the cyberattack.
Why the Breach Matters
Jake Moore, global cyber security adviser at ESET, said attackers often combine information gathered from multiple breaches to build detailed profiles of potential victims before launching phishing emails, text messages or telephone scams. He said information that appears harmless on its own can become far more valuable when combined with data stolen in other cyberattacks, making fraudulent communications appear genuine.
Moore said government departments remain attractive targets because ageing technology, increasing reliance on third-party software and limited cyber security investment can leave public sector organisations vulnerable to sophisticated attacks. He added that incidents affecting government bodies frequently cause disruption well beyond the organisations directly involved.
The government's latest Cyber Security Breaches Survey found cyber incidents remain common across the education sector. More than half of schools reported experiencing at least one cyberattack or security breach during the previous 12 months, while around one in four further education institutions said they experienced attacks at least weekly.
What Affected Staff Should Do
Although the DfE considers the overall data protection risk to individuals to be low because the stolen records cannot easily be linked together, cyber security experts said affected staff should remain alert for unexpected emails, text messages or telephone calls claiming to come from the department, local authorities or other trusted organisations.
Experts recommend checking the sender of any unexpected communication before opening links or downloading attachments. They also advise enabling multi-factor authentication where available, using strong and unique passwords across online accounts, reporting suspicious emails through the National Cyber Security Centre's Suspicious Email Reporting Service, and contacting Action Fraud if fraud is suspected.
