UK education breach exposes more than 600,000 records

A cyber attack on the UK’s Department for Education has exposed more than 600,000 records, adding to concerns over the volume of sensitive information held across the education sector.

 

The Department for Education (DfE) confirmed the breach in late July after a previously unknown cybercrime group calling itself ExfilSquad claimed responsibility. Around 607,000 records were compromised, with data taken from the department’s Help Desk Self-Service Portal and the Turing Scheme Portal.

 

The stolen information reportedly includes names, email addresses, telephone numbers and job titles belonging to people including parents, headteachers, senior school leaders, university staff and government officials. The DfE said it had taken action to contain the incident and was working with the National Cyber Security Centre and National Crime Agency to investigate.

 

ExfilSquad has attempted to extort the department by threatening to release the stolen information. Unlike a traditional ransomware attack, however, there has been no suggestion that the attackers encrypted the DfE’s systems. Instead, the incident appears to rely on data theft and the threat of publication as leverage.

 

The attack highlights a wider challenge facing the education sector. Schools, colleges and universities hold large quantities of personal information while supporting extensive networks of students, employees, devices and third-party services.

 

The government’s latest Cyber Security Breaches Survey found that 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions had identified a cyber breach or attack during the previous 12 months. Among secondary schools, that figure increased from 60% the previous year.

 

Phishing remains by far the most common threat, accounting for 96% of incidents identified by secondary schools and further and higher education institutions. Almost half of further and higher education institutions that experienced a breach also reported a negative impact on their systems, including compromised accounts, disrupted online services and loss of access to files or networks.

 

The DfE has itself warned that education is now among the UK’s most frequently targeted sectors. Its recently updated Cyber Security Hub identifies ransomware, phishing and supply chain attacks among the most common threats facing schools.

 

The latest breach also shows why the consequences do not necessarily end once an attacker leaves the network. Names, roles and contact details can provide useful material for convincing phishing and impersonation attempts, particularly when attackers know where an individual works and what position they hold.

 

For education organisations, protecting that information therefore means looking beyond the initial breach. Identity security, access controls and incident response remain important, but organisations also need to consider how stolen information could be used to target staff, students and partners long after an incident has been contained.