UK Department for Education and Police Database Hit by Data Exfiltration Extortion

Cybercriminals claiming to be ExfilSquad have stolen data from the UK Department for Education and the Police National Legal Database, demanding ransom in exchange for silence.

Key Points:

• ExfilSquad claims to have exfiltrated over 600,000 data lines from the Department for Education, including names, emails, and phone numbers.
• The Police National Legal Database was also compromised, with 135,000 records potentially exposing police officers' identities and work emails.
• The UK government maintains a strict policy against making ransom payments to cybercriminals.
• Ransomware incidents against central government have decreased significantly in recent years, with only four reported in the two years following 2023.

Cyber extortionists identifying themselves as ExfilSquad have targeted two major UK government systems, demanding payment to prevent the release of stolen information. The Department for Education confirmed that two of its portals, the Help Desk Self-Service Portal and the Turing Scheme Portal, were impacted. While the attackers claimed over 600,000 pieces of data were taken, the DfE clarified this refers to data lines rather than individual victims, noting that the risk to individuals is low as the data consists mainly of customer service contact details. No encryption of systems occurred, distinguishing this from traditional ransomware attacks.

In a separate but related incident, the Police National Legal Database (PNLD) was breached, exposing 135,000 records. These records potentially identify the names, forces, and work email addresses of police officers and criminal justice staff. The Home Office declined to comment, but the National Cyber Security Centre confirmed it is supporting law enforcement in responding to the incident. The stolen data does not include protected information from investigations or witness details.

Despite the severity of the breach, the UK government adheres to a policy of not paying ransoms, with legislative efforts underway to further criminalize such payments for public sector entities. This incident occurs against a backdrop of declining ransomware attacks on central government, which dropped from 11 incidents in 2023 to just four in the subsequent two years, according to data from Britain's privacy regulator.

How should government agencies balance transparency with security when responding to data breaches that do not involve sensitive personal or investigative data?

Learn More: The Record

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)