The UK Department for Education (DfE) is investigating a reported cybersecurity incident after The Times reported that more than 600,000 records containing contact information may have been accessed.
According to The Times, the incident affected customer contact information held within the DfE’s customer helpdesk system and the Turing Scheme. The newspaper reported that the data included names, job titles, email addresses and telephone numbers belonging to government officials, school leaders and university staff.
The Times attributed the following statement to a Department for Education spokesperson: “We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed.”
According to the newspaper, the DfE said it took the affected systems offline after identifying the incident and is working with the National Cyber Security Centre, the National Crime Agency and the Information Commissioner’s Office as investigations continue.
The Times also reported that the cybercriminal group ExfilSquad has claimed responsibility for the breach by posting details on the Dark Web. The claim has not been independently verified and no official attribution has been made by UK authorities.
At the time of publication, the DfE had not published a standalone statement about the reported incident on GOV.UK.
Jamie Moles, Senior Technical Manager at ExtraHop, said: “Educational institutions and government bodies hold high-value data and underpin critical public infrastructure, yet they continue to be treated by attackers as soft targets.
“Exposing headteachers, university leaders and officials to targeted phishing and identity theft is a severe operational vulnerability.
“To stop this cycle, public sector organisations must secure their service desks, third-party supply chains, and external tools before bad actors exploit them. Calling in the National Cyber Security Centre (NCSC) and the NCA after a breach is damage control, not a security strategy.
“Institutions need to work hand-in-hand with the NCSC proactively – embedding their Active Cyber Defence tools, sharing real-time threat intelligence, and conducting rigorous resilience exercises long before a breach happens. Upfront cyber investment and the ability to actually see activity in real-time will remain the safer and more effective option than reactive Disaster Recovery, regulatory penalties, and a total loss of public trust.”
