NOTABLENATOB2incident

UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad — a five-day-old extortion brand whose other 14 claims look fabricated

discovered 2026-07-31 04:09 UTCrun 2026-07-31T0409Z-intel5 sourcesmulti-source

The UK Department for Education has confirmed a breach of two public-facing portals, the DfE Help Desk Self-Service Portal and the Turing Scheme Portal, with the compromised material described as customer-service contact details — names, email addresses and phone numbers belonging to parents, officials, school leaders and university staff (The Record, 2026-07-30). Separately affected was the Police National Legal Database, where 135,000 records identify police officers by name, force and work email address; The Record notes the database holds no protected information from investigations or witnesses, and that the Home Office, which owns it, declined to comment. The NCSC has confirmed it is supporting law enforcement colleagues on the response. The extortionists are demanding a ransom; The Record notes that as a matter of policy the British government does not make ransom payments, and that the government has moved forward with plans, not yet law, to make such payments illegal for public-sector entities.

Two details in DfE's own response are worth carrying rather than the headline number. It explicitly corrects the criminals' framing, clarifying that the claimed figure of more than 600,000 pieces of data refers to lines of data rather than the count of individuals affected — a victim disputing the arithmetic behind an extortion claim rather than repeating it. And it assesses the risk to individuals as not high, which is consistent with contact-detail exposure rather than anything more sensitive.

The claimant is where this gets interesting. ExfilSquad's Tor leak site first appeared on 2026-07-26 and immediately listed 15 organisations across government, education, finance and technology. SOCRadar's profile of the group is unusually direct about what that list is worth: it assesses that the listings may involve reused data or fabricated allegations, with fabrication currently appearing more likely (SOCRadar, 2026-07-28). No forensic evidence, data samples, victim confirmations or technical detail about initial access are publicly available for the group, and SOCRadar found no aliases, predecessor operations or rebranding history — this is a brand with no track record at all. It also documents the group posting on social media tagging a major vendor's security-intelligence account with a screenshot resembling an internal directory record, authenticity unconfirmed, which reads as publicity-seeking rather than proof.

So the same list contains one independently confirmed national-government breach and fourteen claims a credible vendor thinks are probably invented. One of the listed companies, semiconductor manufacturer Analog Devices, was added and then quietly removed — the outlet that reported the removal says the reason is unknown and notes that delisting is common when ransom negotiations begin (BleepingComputer, 2026-07-30). Analog Devices separately filed a regulatory disclosure stating it identified unauthorized access to certain systems on 23 June 2026, that its investigation found certain files were exfiltrated, and that it does not believe the incident is reasonably likely to materially impact its business — filed under the non-material "Other Events" item despite the acknowledged exfiltration, which is itself a useful materiality-threshold data point for anyone calibrating their own disclosure playbook (Analog Devices, 2026-07-29). The company has not attributed that intrusion to ExfilSquad or confirmed the group's claims are related, and the record count circulating alongside it is the group's own allegation rather than a company figure (CyberInsider, 2026-07-30). Those are two threads, and the available reporting does not join them.

Defender takeaway

the transferable item here is a triage discipline, not an indicator. When a new extortion brand appears with a long victim list, the volume of claims is not evidence — the base rate for a five-day-old handle with no history is heavily weighted toward recycled or invented data, and acting on a listing before victim or regulator confirmation means spending analyst hours on someone's marketing. The workable test is what happened here: one entry on the list was corroborated by the victim itself, so it is real and scoped; the rest stay unactioned until something outside the leak site says otherwise. The secondary point for the constituency is that both confirmed elements were externally-reachable service portals holding contact data — the sort of help-desk and scheme-administration systems that rarely appear on a crown-jewels inventory but sit on the public internet with real personal data behind them.

135,000 pieces of data potentially identifying the names, forces and work email addresses of police officers

The Record (Recorded Future News) 2026-07-30

the listings may involve reused data or fabricated allegations, with fabrication currently appearing more likely

SOCRadar 2026-07-28

ATT&CK mapping

2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1

Initial Access TA0001

T1190Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

overlap matrix · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

overlap matrix · ATT&CK page ↗

Sources

The Record (Recorded Future News)primary SOCRadarprimary BleepingComputercorroborating Analog Devices, Inc. — SEC Form 8-Kcorroborating CyberInsidercorroborating

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Assessment

NATOB2NATO Admiralty code

Source reliabilityB Usually reliable

Info credibility2 Probably true

Verificationmulti-source

Confidencemedium

The confirmed breach facts come from a DfE spokesperson quoted directly by The Record; the credibility assessment of the wider victim list is SOCRadar's. The two are deliberately kept apart in the body because they support different conclusions. The Analog Devices thread is cited per clause to the three separate sources that carry its parts — the delisting to the outlet that observed it, the intrusion and materiality wording to the company's own filing, and the claimed record count to the outlet that reports it as the group's allegation — because SOCRadar's profile, which lists the company among the 15 claims, carries none of them. The Home Office, which owns the police legal database rather than DfE, declined to comment on that element, so its scope rests on The Record's reporting and the NCSC's confirmation that it is supporting the response.