Personal data breach at Department for Education affects 607,000 lines of data

A newly identified hacking group calling itself ExfilSquad has launched a cyberattack targeting the Department for Education (DfE) and the Police National Legal Database (PNLD), compromising over 740,000 pieces of data. The hacking group have demanded unspecified payments from 14 organisations, threatening to release the complete datasets online if they fail to comply. 

The DfE personal data breach accounted for 607,000 lines of data from its help-desk portal along with additional information from its Turing study-abroad scheme. The stolen data includes customer service contact information, including full names, email addresses, telephone numbers, and job titles belonging to government officials, senior school leaders, university staff, and parents. DfE confirmed that swift action was taken to contain the incident and that no other systems were compromised.

The attack on the PNLD, hosted by West Yorkshire Police, involved approximately 135,000 lines of data. The compromised data includes work contact details and passwords for police officers and criminal justice personnel across England and Wales, as well as the names and addresses of members of the public who submitted queries. Officials, however, stated that the database held no confidential victim, witness, or offender information, and the risk remains low provided stolen passwords are not reused elsewhere. 

Both DfE and the PNLD have reported the breach to the Information Commissioner's Office (ICO).

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.