ExfilSquad Dumps 135,000 UK Police Records on Dark Web Alongside Education Ministry Data in Cyber Spree

A previously unknown hacking group calling itself ExfilSquad has claimed responsibility for stealing 135,000 records from the Police National Legal Database (PNLD) and around 607,000 records from the Department for Education (DfE), posting samples of both datasets on a dark web leak site on 26 July 2026. The two claims form part of a wider spree in which the group listed 14 alleged victims across five countries on the same day, though most of those claims, including one involving Microsoft, remain independently unverified.

PNLD, which supplies legal guidance to all 43 Home Office police forces in England and Wales, said the exposed data included names, employing forces and work email addresses of officers and criminal justice staff, alongside some names and addresses of members of the public who had used its 'Ask the Police' service. The DfE said the stolen records were customer service contact details, including names, job titles, email addresses and phone numbers, taken from its Help Desk Self-Service Portal and Turing Scheme Portal.

What Exfilsquad Claims To Have Stolen and What We Know

ExfilSquad's own dark web posting states that 135,000 law enforcement contact records, containing first and last names, email addresses and police force area assignments, were taken from PNLD, though this figure originates solely from the group's claim rather than PNLD's official statement. Separately, the group claims to have taken around 600,000 records from the DfE's help desk system and a further smaller batch from the Turing Scheme portal used to manage UK students studying abroad. The DfE has confirmed the incident occurred and put the total figure at approximately 607,000 records, while stressing this represents total records rather than distinct individuals, and that no bank details or other highly sensitive information were involved.

Unresolved Discrepancy Over Passwords

Accounts of the PNLD breach diverge on one significant point. One national newspaper has reported that passwords were among the data taken, citing an unnamed source familiar with the investigation. PNLD has not confirmed this account. The discrepancy between the newspaper's reporting and PNLD's public position remained unresolved at the time of publication.

Watchdogs and Agencies Step In

Both organisations have referred the incidents to the Information Commissioner's Office, and the DfE said it is working with the National Cyber Security Centre and the National Crime Agency to establish the circumstances and impact of the breach. An NCA spokesperson confirmed it was aware of the incident affecting the DfE and was working with partners to understand it further.

PNLD said its database does not hold confidential victim, witness or offender information, and assessed the immediate risk to individuals as low.

Combined, the two claimed breaches affect more than 740,000 records across separate arms of UK government and policing infrastructure, though the overall scale and authenticity of ExfilSquad's wider 14-victim claim, including its assertion regarding Microsoft, has not been independently verified by cybersecurity researchers.

The investigation is ongoing, and the full scope of the breach may not be known for weeks.

Cybersecurity specialists have noted that government and public sector bodies are frequently targeted due to resourcing constraints, though no attribution of ExfilSquad's tactics or motive beyond its own leak site claims has yet been confirmed. A named spokesperson was not available for comment at the time of publication.