Hackers have stolen more than 600,000 pieces of data in a major cyber attack on the Department for Education (DfE). The breach, understood to have taken place last week, saw 607,000 records taken, including names, job titles, telephone numbers and email addresses of government officials, school leaders and university staff. The figure does not correspond to the number of people affected.
Breach details and response
The attack involved the Turing Scheme portal – a programme providing funding for international education – and the department's online help desk. The DfE has switched to using the telephone while work to fix them is carried out. The DfE said the breach was quickly contained and that the data protection risk to individuals is not high.
The department also said it is working closely with the National Cyber Security Centre and the National Crime Agency (NCA), and has reported the incident to the Information Commissioner's Office. According to dark web posts, a group called ExfilSquad claimed responsibility for the breach, reports The Times.
Reactions and assurances
A DfE spokesperson said: "We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed. We continue to work closely with the National Cyber Security Centre and the National Crime Agency."
Paul Whiteman, general secretary of school leaders’ union NAHT, said: "These reports are concerning. While school leaders' names and email addresses will largely be in the public domain anyway, the DfE needs to act quickly to reassure people by clarifying exactly what information has been accessed and that it goes no further. Cyber leaks can have serious consequences and so it will be incumbent on the department to get to the bottom of what has happened and reassure the sector that steps have been taken to prevent any recurrence."
