The UK Department for Education has suffered a data breach via a social engineering attack aimed at an internal helpdesk.

The apparent threat actor is known as ExfilSquad, which reportedly stole over 600,000 records which included the personal information – names, phone numbers, email addresses – of staff from universities and the government, and school officials like headteachers.

First reported by The Times, those claiming to be ExfilSquad made several posts on the dark web with some of the leaked data, which the newspaper says it has verified.

The education department has since confirmed the incident.

“We have robust processes in place to protect information and took swift action to contain this incident,” a Department for Education spokesperson said.

“The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed. We continue to work closely with the National Cyber Security Centre and the National Crime Agency, and remain in contact with those affected.”

The internal helpdesk and the Turing Scheme portal – an international education funding programme – have been affected in the attack and have both been taken offline.

Recommended reading

• The Unique Cybersecurity Threats Facing Education Institutions
• Comment | UK Education Sector Must Step Up its Cybersecurity Posture
• CyberScotland Week: Improving Cyber Hygiene in Scottish Schools

In total, 607,00 records were affected in the breach, but this does not reflect the total number of individuals affected.

“We are aware of an incident affecting the Department for Education and are working with partners to understand the circumstances and impact,” an NCA spokesperson said.

Not much is known about the group claiming the attack, ExfilSqaud. Relatively new to the game, the group took credit for a yet to be credited breach on Microsoft just days ago. The group has previously made unverified claims of breaches and attacks without screenshots or proof.

Meanwhile, the UK’s education sector continues to be targeted by ransomware and other cyber-crime groups, with over half of schools reporting a breach or attack in the last year, according to government reports.