UK Department for Education helpdesk portal breach (ExfilSquad extortion)

On 29 July 2026, the UK Department for Education (DfE) confirmed that attackers had stolen around 607,000 records from two of its online services: the DfE helpdesk self-service portal used by schools, universities and local authorities, and the Turing Scheme portal, which education providers use to manage funding for international placements. The confirmation came days after the data-extortion group ExfilSquad claimed the attack on its leak site on 26 July and threatened to publish the data.

The department said the breach was contained quickly and that it switched to telephone support while the affected services were repaired. It reported the incident to the Information Commissioner's Office and was working with the National Cyber Security Centre and the National Crime Agency.

What was exposed

According to the DfE, the stolen data consisted of customer-service contact details: names, job titles, telephone numbers and email addresses of government officials, school leaders such as headteachers, and university staff. The department said no bank details or other highly sensitive information were involved and assessed the risk to individuals as "not high". Reporting described the attack as relying on social engineering against the helpdesk rather than encryption of systems; there was no suggestion that ransomware was deployed.

Why it matters

Even without financial data, a list of senior school and university contacts with their roles and direct phone numbers is ideal material for targeted phishing and payment-fraud campaigns against the education sector. The incident also illustrates the growing number of extortion crews that skip encryption entirely and monetize stolen data alone, including against central government departments.