Hackers Steal 607,000 Contact Records From Department for Education in England

The Department for Education (DfE) has confirmed a cyber-attack that saw hackers access around 607,000 records, with the stolen data including telephone numbers and email addresses linked to individuals and organisations. The department said no financial details were among the material accessed.

Officials have stressed that the breach was identified and contained quickly, and that the overall risk to affected individuals is limited. Even so, the scale of the exposure has raised questions about the security of contact data held by government departments.

The Data That Was Stolen and What Wasn't

A DfE spokesperson said the department has 'robust processes in place to protect information' and took 'swift action to contain this incident'. The spokesperson added that the information involved is 'limited to customer service contact details relating to individuals and organisations', stressing that 'no other data has been accessed'.

The department has clarified that the 607,000 figure refers to the total number of records affected, not the number of individuals impacted. This means some people may appear more than once across multiple records, so the true number of people affected is likely lower than the headline figure suggests.

Two DfE Services Disrupted by the Attack

Two DfE services have been disrupted by the attack: the Turing Scheme portal, which administers funding for international education placements, and the department's online help desk. The department took both services offline as part of its containment response.

The DfE has not confirmed a precise date for their return, though it expects both services to resume normal operation later this week. In the meantime, applicants and organisations relying on Turing Scheme funding may face short-term delays in accessing support.

Rising Threat to Education Sector

The DfE breach comes amid a broader rise in cyber-attacks targeting UK education institutions. According to the government's most recent Cyber Security Breaches Survey 2025/26, around a quarter of further education institutions, 24 per cent, reported experiencing a breach or attack at least weekly.

The same survey found that more than half of schools reported at least one attack or breach within the past year. That pattern has made the education sector one of the more frequently targeted areas of UK public services, alongside healthcare and local government.

NCA and ICO Step in To Investigate

The DfE said it is working alongside the National Cyber Security Centre and the National Crime Agency (NCA) to investigate the breach. An NCA spokesperson confirmed involvement, stating: 'We are aware of an incident affecting the Department for Education and are working with partners to understand the circumstances and impact.'

The department has not announced a timeline for the investigation's conclusion. It has also referred itself to the Information Commissioner's Office (ICO) as a precaution, meaning the watchdog will independently assess whether the DfE met its data protection obligations under UK law.

That ICO review could result in further findings, recommendations, or in more serious cases, regulatory action, though it is too early to say which outcome applies here. The department has not indicated whether affected individuals or organisations will be contacted directly. Its statement that the risk to individuals is 'not considered high' suggests a mass notification exercise is not currently planned, though that could change as the NCA's investigation develops.

For the 607,000 individuals and organisations whose data was exposed, the question now is whether the DfE's assurance that risk is 'not considered high' will hold, and whether the ICO will agree.