A previously unknown extortion crew calling itself ExfilSquad has claimed roughly 135,000 records from the UK Police National Legal Database (PNLD), the criminal law reference platform hosted by West Yorkshire Police and used by all 43 Home Office forces in England and Wales. The PNLD theft is one half of a wider campaign totalling more than 740,000 records and lines of data, the bulk of it (reported as 607,000 by TweakTown, EdTech Innovation Hub and PublicTechnology, and as "just over 600,000" by the Guardian) taken from the Department for Education's help-desk self-service portal, with a smaller set from the DfE's Turing Scheme portal. Both PNLD and the DfE have now publicly acknowledged the incident, and the group is demanding payment from both victims to stop the full dataset being published. The claim first surfaced on a criminal forum around 25 July 2026 and was treated as unverified for several days before official confirmation on 29 and 30 July.
What Happened
The sequence matters here, because it is a textbook example of a claim outrunning confirmation. On 25 July, breachnews.com and Undercode News both reported a dark-web post in which a threat actor claimed to hold PNLD data. At that point neither PNLD nor West Yorkshire Police had said anything, breachnews described the claim as "not independently verified", and Undercode noted the public post contained no screenshots, no file samples, no ransom note and no technical evidence at all. Undercode's account and breachnews' account differ materially on substance: breachnews described a detailed published sample, while Undercode said no sample was visible in the post it saw. Treat the early dark-web reporting as a signal, not a finding.
Confirmation came on 29 July via the Guardian, which reported that ExfilSquad had claimed both the DfE and PNLD intrusions and posted data samples on its own leak site. The Guardian saw screen grabs of the extortion messaging, supplied by Sophos, in which the attackers told the DfE to "be smart and just pay", framing a ransom as a "rounding error" against the cost of litigation.
The DfE has referred itself to the Information Commissioner's Office and says it is working with the National Cyber Security Centre and the National Crime Agency. Its spokesperson stated: "We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed." The department argues the data-protection risk is "not considered high" because the helpdesk data comprises separate sets that cannot be linked together. PNLD has confirmed the theft of contact details but says the database holds no confidential victim, witness or offender information.
What Was Taken
On the PNLD side, the operator's own statement is the strongest source and describes the affected data as relating to "police officers and those working in criminal justice including their name, the force or organisation they work for and their work email address", plus names and addresses of some members of the public who had previously submitted a question through the Ask the Police service.
The criminal claim is broader. breachnews.com, an OTHER-tier source reporting an unverified forum post, says the dataset also contains portal account details, login timestamps, authentication settings and internal system identifiers. That has not been confirmed by PNLD or West Yorkshire Police and should be carried as an allegation rather than an established fact. Separately, the Guardian's reporting indicates the PNLD compromise includes passwords used to access the site, and TweakTown cites a senior source briefed on the leak warning that impact escalates sharply if officers reused PNLD credentials on other systems. Accounts therefore differ on credential exposure: the operator statement mentions only name, force and work email, while press reporting points to password material in the stolen set.
For the DfE, the stolen records include full names, email addresses, phone numbers and job titles for parents, teachers, senior school leaders, higher-education staff and government officials. EdTech Innovation Hub makes an important qualifier explicit: 607,000 is a count of records, not 607,000 distinct people. The DfE says no bank or financial details were taken.
Aggregate figures across the sources are consistent at "more than 740,000" records and pieces of data, with the split reported as roughly 607,000 (DfE, plus an unspecified smaller Turing Scheme set) and 135,000 (PNLD).
Why It Matters
The PNLD content itself is legal reference material, not casework, which is why UK reporting has characterised the breach as embarrassing rather than serious. That framing understates the operational risk in one specific respect: the value of this dataset is not the legal text, it is the identity graph. A verified roster of 135,000 names mapped to forces, organisational roles and working email addresses across every Home Office force, the British Transport Police, the Crown Prosecution Service, the Independent Office for Police Conduct and HM Courts and Tribunals Service is close to ideal targeting material for phishing, pretexting and helpdesk social engineering against law enforcement staff.
Pair that with the credential-reuse warning and the exposure compounds. A PNLD password is low-value in isolation and high-value if it also unlocks a force intranet, a case management system or a personal mailbox used for MFA recovery.
The wider context is a UK public sector under sustained pressure from English-speaking extortion crews. On 16 July 2026, the BBC reported that Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five years and six months over the 2024 Transport for London attack carried out under the Scattered Spider banner, an incident that forced in-person password resets for all 27,000 TfL staff and produced a customer dataset still circulating in criminal channels. The NCA has named the rise of young UK-based hackers as one of the country's biggest cyber security threats. ExfilSquad has no established attribution or known link to that ecosystem, but the playbook is the same: steal contact data, stand up a leak site, publish samples, demand payment.
The Attack Technique
Initial access is not established for either victim. No source describes how ExfilSquad reached the DfE help-desk portal, the Turing Scheme portal or PNLD, when the intrusions occurred, or whether access persists. breachnews.com noted explicitly that the threat actor provided no information on timing, access method or continued presence.
What can be read from the targeting is that all three named systems are internet-facing service portals with large registered user bases rather than core operational back ends. That pattern is consistent with either exploitation of an exposed application or abuse of legitimate portal credentials, and it echoes the broader trend of attackers going after helpdesk and self-service tiers precisely because they aggregate contact data at scale while sitting outside the hardest security controls. Absent a vendor advisory or a CERT bulletin, anything more specific is speculation.
The extortion tradecraft is well documented: a dedicated leak site, published samples as proof, and direct pressure on multiple victims simultaneously with an economic argument for paying.
What Organizations Should Do
- Force a password reset for all PNLD account holders and hunt for reuse. Given the conflict between PNLD's statement and press reporting on whether passwords were taken, assume they were. Reset PNLD credentials and require any user who reused that password elsewhere, particularly on force systems or personal accounts tied to MFA recovery, to change it there too.
- Treat the 135,000 contact records as live phishing infrastructure. Brief officers and criminal justice staff that their name, force and work email are now in criminal hands, and expect targeted lures referencing PNLD, legal updates or account reverification. Tune mail filtering for spoofed PNLD and West Yorkshire Police branding.
- Harden the helpdesk against social engineering. Attackers holding verified name, role and force data can pass weak identity checks. Move service desks to callback verification or an out-of-band factor for any password reset or MFA re-enrolment request.
- Audit internet-facing self-service and support portals. Inventory every externally reachable helpdesk, ticketing and grant or scheme portal, review authentication and authorisation on each, and check what volume of contact data a single authenticated or unauthenticated session can enumerate. Rate-limit and alert on bulk record access.
- Apply phishing-resistant MFA to reference and low-sensitivity systems too. PNLD was written off as low risk precisely because its content is public legal material. The user directory made it valuable. Sensitivity of content is the wrong criterion for control selection when the user list is the asset.
- Preserve evidence and get regulatory reporting moving early. The DfE self-referred to the ICO and engaged the NCSC and NCA. Any organisation with staff in the affected datasets should log the exposure, capture leak-site samples for scoping, and assess whether its own notification duties are triggered.
- Do not treat unverified leak-site claims as either true or false by default. This incident sat as an unconfirmed forum post for four days before confirmation. Build a triage path that assigns a working confidence level and a monitoring action, rather than waiting for press confirmation to start defensive work.
Sources: Hackers breach UK government and police systems, steal passwords an... | Teen hackers who live streamed cyber-attack on TfL jailed | Hackers steal sensitive data from UK Department for ... | UK Police Legal Database Allegedly Breached | Hackers steal 740,000 UK education and police records ETIH EdTech... | DfE and police organisation hit by cyberattack – PublicTechnology | Hackers steal sensitive data from Department for Education and poli... | Dark Web Claims UK Police National Legal Database Was Leaked: What...