The UK Government’s Department for Education and a police national legal database have been targeted in an online hack by a new cyber gang.
ExfilSquad has claimed responsibility for a breach that has exposed more than 600,000 files from DfE’s help portal, including the full names, email addresses, phone numbers and job titles of parents and staff. It also includes more than 7,000 records from DfE’s ‘Turing Scheme’ portal, a programme providing funding for international education.
The leak from the police national legal database (PNLD), which provides legal assistance to UK police forces, has revealed more than 135,000 pieces of data, including names of police officers, legal staff and the organisations they work for.
Futurescot has seen the dark web portal belonging to ExfilSquad, and it lists the DfE hack as amounting to 440 megabytes of ‘uncompressed’ data. The data is downloadable via a torrent link.
The same is the case for the police national legal database, with its ‘uncompressed’ data amounting to 1.9 gigabytes.
The DfE incident, which has also referred itself to the Information Commissioner, is being investigated by the National Crime Agency. PNLD, which is hosted by West Yorkshire police, has also referred itself to the Commissioner.
An NCA spokesperson said: “We are aware of an incident affecting the Department for Education and are working with partners to understand the circumstances and impact.”
A DfE spokesperson added: “We have robust processes in place to protect information and took swift action to contain this incident.
“The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed”.
Relatively little is known about ExfilSquad, which appears to have started operations in the last four days and claims to have amassed 15 victims in that time from countries spanning the US, the UK, Sweden and Nigeria.
On their dark web portal, they say: “We have made samples for the breaches currently listed available for free download because many individuals, naturally, are skeptical of our claims. Remember that these amounts pale in comparison to the entirety of the data we possess.”
They then warn that the payment they demand is “a rounding error compared to the litigation costs of your data leaking. Be smart and just pay.”