UK Department for Education Hit by ExfilSquad: 607,000 Records Stolen, Emerging Ransomware Group Claims 15 Organizations in One Week

On 29 July 2026, the UK Department for Education confirmed attacks on its external helpdesk and Turing Scheme portals. About 607,000 records were stolen by emerging ransomware group ExfilSquad; NCSC and NCA are investigating, and the group also claimed compromise of the UK Police National Legal Database in the same week.

On 29 July 2026, the UK Department for Education (DfE) confirmed a cyberattack on its external customer helpdesk portal and Turing Scheme portal. About 607,000 records were stolen by emerging ransomware group ExfilSquad. Stolen data includes names, phone numbers, emails, and job titles. This is the group's 15th large-victim claim in one week. UK NCSC and NCA have joined the investigation.

Incident Overview

On 29 July the DfE confirmed attacks on two public-facing portals: the online customer helpdesk and the Turing Scheme international scholarship application portal. About 607,000 records were stolen. Leaked data covers names, phone numbers, emails, and job titles of parents, government officials, senior school leaders, and university staff. DfE stated that bank account details were not obtained. Impact is limited to customer-service contact data.

ExfilSquad publicly claimed the attack. It also claimed compromise of the UK Police National Legal Database (PNLD). Sophos assessed some published samples as appearing legitimate. Besides the two confirmed government victims, ExfilSquad claimed attacks on 13 other large organizations in the same week, including Microsoft. The Microsoft 13GB data claim has not been independently verified. NCSC and NCA are investigating. The UK Information Commissioner's Office (ICO) has been notified.

Technical Details

The core issue: the customer helpdesk portal was treated as an external service. Operators applied weaker monitoring, access logging, and threat detection than for internal systems. Attackers exploited this external-portal trust gap. They remained undetected and bulk-exported data.

From published sample characteristics, ExfilSquad's attack chain likely includes:

• External asset discovery: identify internet-exposed helpdesk systems without WAF protection via Shodan, Censys, and similar internet-mapping platforms.
• Initial access: known vulnerabilities or default admin credentials in helpdesk software (Zendesk, self-hosted Freshdesk, custom portals).
• Persistence: backdoor inside legitimate portal processes. Data export via legitimate application APIs. Bypasses traditional EDR alerts that key on anomalous processes.
• Exfiltration: long-running, small-batch exports using chunking, compression, and encryption. Avoids traffic-threshold network alerts.
• Extortion: publish sample data as proof. Issue ransom threats to the victim. Public claims to build the ransomware brand.

Impact Assessment

• CVSS rating: classified as Significant under NIST SP 800-61 incident severity.
• Exploit complexity: medium. Attackers rely on deep portal reconnaissance and legitimate API abuse. A single traditional security product is unlikely to detect this alone.
• Actual harm: 607,000 PII records of government public-service personnel leaked; reputational damage to DfE and PNLD; reduced public trust in government digital services.
• Attacker profile: ExfilSquad appeared suddenly and claimed 15 large victims. Matches emerging ransomware groups that build reputation through volume.
• Follow-on risk: with name + job title + contact triples, attackers can run targeted spear-phishing or BEC against DfE and university senior staff.

Remediation

• Treat external portals equally: put customer portals, support tickets, and grant applications under the same monitoring, access logging, and detection as internal systems.
• Credentials and auth: disable default portal admin credentials. Enforce MFA. Restrict admin API calls by source IP and device fingerprint.
• Data minimization: store only required fields. Periodically purge unused PII. Avoid large data hoards.
• Anomaly detection: SIEM rules for long-running low-volume outbound traffic, API-call entropy anomalies, and off-hours bulk queries.
• Threat intel: subscribe to NCSC early-warning and CISA AIS. Track ExfilSquad IOC and TTP updates.
• User notification: notify affected individuals under GDPR and the UK DPA 2018. Provide identity-theft monitoring and anti-phishing guidance.
• Tabletop: run regular exercises for public-portal compromise. Validate identify, isolate, notify, and recover end to end.

Sources

• CybelAngel: Cyber Roundup — Week of August 3, 2026
• Check Point Research: 10th August – Threat Intelligence Report