01Summary
On 26 July 2026 ExfilSquad posted samples on a dark-web leak site. The DfE confirmed that 600,000 records were taken from its help-desk portal: names, emails, phone numbers and job titles of parents, school leaders, university staff and officials. A smaller dataset came from the Turing scheme study-abroad portal. The PNLD lost about 135,000 records, mainly work details of police officers and criminal justice staff plus "Ask the Police" inquiries, and confirmed the theft in early August. The group threatened to release everything unless paid. The DfE found no ransomware.
02Victims and impact
Additional victims
- Police National Legal Database (PNLD)
Countries affected
- United Kingdom
03Data exposed
Data types
- Names
- Email addresses
- Phone numbers
- Job titles
- Police officer work details
- Public inquiries
04Timeline
- 2026-07-26ExfilSquad posts DfE and PNLD samples.
- 2026-08-03PNLD confirms the data theft.
05Disclosure and media
Publishing organisations
- The Register
- Computing
- Infosecurity Magazine
- Cybernews
06Sources
References
- [1]The Register: https://www.theregister.com/cyber-crime/2026/08/03/police-national-legal-database-confirms-data-theft-after-dark-web-leak/5282332
- [2]Computing: https://www.computing.co.uk/news/2026/security/uk-police-legal-database-breach-exposes-details-of-more-than-100-000-officers-and-staff