ExfilSquad Leaks Data of 135,000 UK Police and 600,000 Education Records

The cybercriminal group ExfilSquad has breached several high-profile UK government systems, leaking the personal data of approximately 135,000 police officers and over 600,000 education records. The breach represents a significant security failure across critical state infrastructure, exposing sensitive personnel details on the dark web.

According to reports from IBTimes UK and Anadolu Ajansı, the attackers successfully infiltrated the Police National Legal Database (PNLD) and the Department for Education (DfE). From the PNLD, the group exfiltrated roughly 135,000 records containing the names, contact details, and force affiliations of law enforcement personnel and criminal justice workers. Simultaneously, 607,000 records from the DfE were exposed, primarily through the department's online help desk and the Turing Scheme portal. This campaign was not limited to these two entities; ExfilSquad also targeted the Ministry of Defense, the Home Office, the National Crime Agency (NCA), and the Crown Prosecution Service (CPS).

Critical Infrastructure Under Fire

The Police National Legal Database serves as a vital online resource for police forces across England and Wales, providing essential guidance on criminal justice legislation. The breach occurred amidst a broader surge in cyber activity targeting Western institutions. ExfilSquad attempted to leverage the stolen data for financial gain, explicitly demanding payment to prevent the further dissemination of the records. In a statement posted to the dark web, the group claimed that once data is public, it remains so forever, describing their requested payment as a "rounding error" compared to the potential litigation costs facing the victims.

Operational and Physical Risks

The implications of this leak extend beyond digital privacy, posing a direct threat to the physical safety of UK law enforcement. By exposing the identities and contact information of officers, the breach potentially compromises those involved in high-level investigations and serious organized crime. One affected officer told Anadolu Ajansı that the leak is "very disconcerting" and puts personnel at serious risk, particularly those who have put high-level criminals behind bars and may now face retaliation.

The Path Forward

UK authorities are now tasked with mitigating the fallout from a breach that spans multiple government departments and the national police infrastructure. While the scale of the data loss from the PNLD and DfE is confirmed, the full extent of the compromise within the Ministry of Defense and the Home Office remains a critical point of concern. Security analysts will be watching for further data dumps from ExfilSquad and whether this breach leads to a wider systemic overhaul of how the UK government secures its inter-departmental legal and educational databases.