The Department for Education (DfE) has confirmed that a cyber attack on two of its external-facing systems resulted in the theft of around 607,000 records, in one of the largest breaches to hit the UK public sector this year.
The attack targeted the DfE’s online customer help desk and the Turing Scheme portal, which administers funding for international education and training placements for schools, colleges and universities. The stolen data includes names, job titles, work email addresses and telephone numbers belonging to individuals and organisations that had previously contacted the department, among them school leaders, university staff and government officials. The DfE has said the 607,000 figure refers to individual lines of data rather than the number of people affected, and that no financial information was accessed.
A threat group calling itself ExfilSquad has claimed responsibility for the attack and is reported to have published the stolen data online. The Times, which broke the story, said it had seen the names and email addresses of headteachers among the leaked material. The DfE has referred itself to the Information Commissioner’s Office (ICO) and is working with the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) to investigate. A spokesperson said the department has “robust processes in place to protect information” and took swift action to contain the incident, adding that the risk to individuals is not considered high.
The breach has prompted a wave of reaction from the cybersecurity industry, much of it focused on the vulnerability of help desks and customer-facing portals as an entry point into otherwise well-defended government systems.
Graeme Stewart, head of public sector at Check Point, said the breach fits a wider pattern of attacks on the sector rather than standing apart from it. “This breach is a reminder that government departments remain a high-value target precisely because of the volume and richness of contact data they hold. Names, roles, phone numbers and email addresses are exactly what attackers need to run convincing spear-phishing campaigns against schools, universities and other public bodies that trust DfE communications.
Check Point’s own threat data shows education is currently one of the most targeted sectors globally, facing thousands of attacks per organisation every week, and in the UK, in June of this year, it sat as the most frequently targeted industry. This breach fits that pattern rather than being an outlier. The fact that this follows other recent breaches across the public sector, including the Foreign Office attack last year, shows a pattern rather than a one-off failure. Departments need to treat help desks and third-party support systems as high-risk attack surfaces, not just back-office admin tools, because that’s clearly where attackers are focusing their efforts. With the NCSC reporting a steep rise in nationally significant attacks, this can’t be treated as an isolated incident. It should prompt a wider review of how sensitive contact data is stored, segmented and monitored across government IT estates.”
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, agreed that the help desk remains one of the weakest links in enterprise and public sector security alike, and argued the incident should trigger scrutiny well beyond the DfE itself. “The help desk remains one of the most consistently exploited entry points in enterprise and public sector environments, and the fact that it’s happening inside a government department managing sensitive educational data shows the public sector is just as exposed as the private sector, often more so. 607,000 records is a significant number, but the details matter as much as the volume.
Names and email addresses belonging to government officials, senior school leaders, and university staff are a high-value targeting dataset. These are people with institutional authority, access to sensitive systems, and in many cases responsibility for safeguarding student data. In the wrong hands, this isn’t just a data privacy incident; it’s a ready-made list for spear phishing campaigns against people with meaningful access across the education sector. The DfE deserves credit for referring itself to the ICO and engaging the NCA and NCSC promptly; that’s the right response and faster than many organisations manage. But the deeper question this raises is one Parliament should be pressing: if a government department managing data on hundreds of thousands of students, officials, and educators is vulnerable to a help desk attack in 2026, how many other departments are equally exposed through the same vector?”
Kevin Curran, senior IEEE member and professor of cybersecurity at Ulster University, placed the breach in the context of the government’s own data on attacks against the sector. “This recent cyber-attack on the UK Department for Education involving the theft of around 607,000 records highlights the sheer volume and persistence of attacks, especially phishing and related techniques, meaning breaches continue to occur at elevated rates. The education sector in England faces a higher volume of cyber incidents compared with other areas, according to the government’s Cyber Security Breaches Survey 2025/26. The most common attacks are phishing, malware, denial-of-service, and unauthorised access. This leads to service disruption and a myriad of operational effects. Educational authorities often face high volumes of lower-sophistication attacks while managing limited specialist capacity. This incident itself illustrates that even central government systems with robust processes remain vulnerable, particularly via social engineering on customer-facing portals that handle high volumes of legitimate enquiries from the sector. This is not unique, as public-sector organisations in the UK have faced a series of notable incidents in recent years.”
Curran added that the leaked contact details create a tangible risk for anyone who deals with the department. “Unfortunately, the leaked professional contact details create a practical risk of highly targeted phishing or social engineering campaigns against school leaders, academy trusts, universities, and local authorities. Attackers can craft convincing messages that reference real interactions with the DfE or the Turing Scheme. Organisations and individuals whose details may be involved should be alert to unexpected requests, verify communications through alternative channels, and reinforce multi-factor authentication and staff awareness. This incident is a reminder that public-facing systems remain attractive, lower-barrier targets even when more sensitive core data is better protected.”
Camellia Chan, CEO and co-founder of X-PHY, said the breach was a reminder that education providers’ exposure extends well beyond their own networks. “The Department for Education breach reinforces what the wider education sector should already know: protecting sensitive information extends beyond an organisation’s own network. Personal and institutional data may also be held across government platforms and other external services, creating additional routes for attackers to exploit. With 98% of higher education institutions and 73% of secondary schools experiencing cyberattacks in the last year, security should be a top priority for every organisation handling education data. What’s needed is 24/7 proactive prevention that protects students, families and teachers by stopping threats before information is exposed, rather than heightened vigilance once the damage has been done.”
She added that static defences are no longer sufficient on their own: “As the cyber threat landscape becomes increasingly complex, rules-based approaches that rely on known patterns are becoming less effective, particularly as attackers adopt AI. True resilience requires a multi-layered approach that can detect suspicious activity across both internal systems and third-party environments and autonomously secure data before an attack spreads.”
Others focused less on prevention and more on what happens after the breach. Dave Spence, cybersecurity lead at DXC Technology UK&I, argued that resilience and recovery deserve as much attention as keeping attackers out in the first place. “Cyber incidents are no longer a question of if, but when, so organisations should be focusing just as much on resilience as they do prevention. The real differentiator isn’t whether an organisation is prepared to deflect an attack, rather, how quickly and confidently it can recover. The preparation should start well before an incident – recovery rehearsals should sit alongside preventative security measures so teams understand their roles and can restore critical operations as quickly as possible. As organisations increasingly adopt AI, they also need to consider how it changes the threat landscape while using its capabilities to strengthen detection, response and resilience. It’s also critical to recognise that technology alone isn’t enough. The people managing incident response, the processes they follow and the planning that’s already been done all play a vital role in recovery. Organisations should be asking not only whether they’re secure, but whether they’re recoverable. Building recovery into cybersecurity strategies from the outset will put businesses in a much stronger position when an incident does occur.”
Spencer Starkey, executive vice president EMEA at SonicWall, said the breach fits into a broader surge in attacks against public services and critical national infrastructure, and warned of the ways stolen education data can be monetised. “It’s no surprise we have seen a clear surge in cyberattacks on the public sector and CNI. And for cybercriminals, the education sector is a powerhouse of data holding incredibly sensitive information. Hackers can use the data for two different attack types: phishing and financial crime. By stealing students’ and parents’ information, they can impersonate individuals in phishing attacks. But hackers can and will also leverage this data to replicate students’ or staff members’ identities for financial crime. An example of this is ransomware, cyber criminals are able to hold this data they steal from educational institutions for ransom for a high price. These disruptions aren’t minor; they directly affect citizens and erode public trust. Without a decisive shift toward AI-native security strategies across both the public and private sectors, we risk a scenario where public services and critical infrastructure simply cannot keep up with the velocity of what’s coming. And this is a clear example that what’s coming isn’t slowing down.”
The breach has also raised uncomfortable questions about the standards the DfE holds itself to versus those it expects of the schools and colleges it regulates.
Jamie Akhtar, CEO and co-founder of CyberSmart, said the incident “raises important questions, particularly given the Department for Education’s role in setting cyber-security expectations for schools and colleges.” He noted that “Reports say more than 607,000 records were taken from the DfE’s Customer Help Portal and Turing Scheme systems, including names, job titles, email addresses and phone numbers. The Customer Help Portal is used to submit and track enquiries, complaints and requests, with previous enquiries stored against linked DfE accounts.” Akhtar was careful not to speculate on the cause while the investigation continues: “We do not yet know exactly how the attackers gained access, so it would be wrong to speculate about which control (or controls) failed. But the department should be clear about whether the right basic safeguards were in place, whether the systems had been properly tested, and why such a large amount of data could be taken without raising alarms.”
He pointed to the government’s own minimum security standard as the benchmark the DfE should be judged against: “Cyber Essentials is the Government’s recommended minimum standard, and colleges are expected to hold it through their funding agreements. The Government cannot credibly ask schools and colleges to meet that standard without being transparent about whether its own services met it too.” Akhtar added that transparency with those affected matters as much as the technical response: “The information taken may look limited, but names, roles, phone numbers and email addresses can still be used to create convincing phishing and impersonation attempts. The DfE should make sure everyone affected knows what was exposed and what to look out for, rather than treating this simply as a technical incident. Cyber Essentials will not prevent every breach, but it helps make sure the basics are in place. Once the investigation is complete, the DfE should explain what happened, what failed and what it is doing to stop it happening again.”
Darren Guccione, CEO and co-founder at Keeper Security, said the incident underlines how much value attackers can extract from contact data alone. “The reported breach at the Department for Education is a reminder that contact information alone carries significant value to attackers. Based on what has been confirmed so far, the exposed records include names, job titles, email addresses and telephone numbers relating to individuals who have engaged with the department. While this might not carry the same weight as financial or highly sensitive personal data, it provides the context cybercriminals need to orchestrate convincing phishing, smishing and voice-based social engineering campaigns.”
He pointed to Keeper’s own research into the pressures facing the sector: “This breach lands against an already difficult threat backdrop for the sector. Keeper’s research into AI and cybersecurity in UK education found that 42% of UK education institutions have already been targeted by AI-generated phishing attempts, and 93% are at least somewhat concerned about AI-related cybersecurity threats – figures that reflect a sector under sustained and growing pressure.”
Guccione urged anyone affected to be on their guard in the coming weeks: “Anyone whose details may have been exposed should treat the coming weeks with heightened caution. Attackers routinely use leaked contact information to build credibility, referencing roles, institutions or prior interactions to make unsolicited outreach appear legitimate. That applies to emails, text messages and phone calls alike. Display names and caller IDs can be spoofed. Any unexpected request for login credentials, access or sensitive information should be verified through a trusted, independent channel before acting on it.”
He also drew a broader lesson about where organisations should focus their defences: “For both public and private sector organisations, this incident reinforces a broader lesson about identity security. The attack vector here matters: the DfE helpdesk was the entry point. Helpdesks are high-value targets precisely because they are trusted, frequently accessed and often subject to weaker identity verification controls than core enterprise systems. Strong identity and access management, least-privileged access enforcement, multi-factor authentication and continuous monitoring all help reduce the likelihood that a compromised account can lead to a large-scale data exposure. It also highlights why breach preparedness matters. Rapid detection and swift containment are essential once an attacker is inside. The question is never just whether a breach can happen. It’s how quickly an organisation knows, and how much damage it can contain.”
Andrew Willdig, Group CEO of iStorage, believes incidents like this should encourage organisations to take a closer look at how they protect sensitive data wherever it is stored or shared.
“This breach is a reminder that no organisation is immune to data breaches. Protecting sensitive information requires more than just securing your network. Organisations also need to invest in employee awareness, strong identity security and robust processes for managing third-party access, as human behaviour remains one of the biggest security challenges. At the same time, sensitive data should remain protected wherever it goes. If it falls into the wrong hands, it should remain unreadable and unusable.”
Willdig believes many organisations still have a fundamental misconception about data security, focusing heavily on network protection while overlooking human factors, third-party access and what happens after sensitive information is downloaded, transferred or stored outside the corporate environment. “One of the biggest misconceptions is that once you’ve secured your network, your data is secure. But that’s only part of the story. Information is constantly being downloaded, copied and shared across laptops, portable storage devices and other removable media. Organisations also need to recognise that technology alone isn’t enough. Regular staff training, raising awareness of social engineering tactics and secure third-party access all play an important role in reducing risk. Data needs to be protected wherever it goes, and unfortunately many organisations are leaving a significant gap in their data security strategy.”
The DfE has not set out a timeline for concluding its investigation. The affected help desk and Turing Scheme services, which were switched to telephone support while remediation work took place, are expected to return to normal operation shortly.
