Cyber-attack on England's Department for Education exposes 607,000 records
Contact details for individuals and organisations were taken in a breach affecting two government education portals. No bank details were stolen, but the incident lands as UK school and college cyber-attacks hit record frequency.
Key points
- Attackers stole roughly 607,000 records from England's Department for Education (DfE) in a recent cyber-attack.
- The stolen data covers telephone numbers and email addresses only; no bank details or passwords were taken.
- Two DfE services were disrupted: the Turing Scheme portal and the DfE online help desk.
- The DfE has referred itself to the Information Commissioner's Office, the UK regulator that enforces data-protection law.
- Government figures show more than half of UK schools reported a cyber-attack or data breach in the past year.
England's Department for Education has confirmed that attackers broke into at least two of its online systems and took approximately 607,000 records containing contact information belonging to individuals and organisations.
The DfE was quick to stress that the figure covers records, not unique people. A single person could appear in multiple records, so the number of individuals actually affected is likely lower. No bank details, passwords, or other sensitive personal data were involved.
What exactly was taken?
The stolen records contain telephone numbers and email addresses. That is it. A DfE spokesperson said the information "is limited to customer service contact details relating to individuals and organisations" and that "no other data has been accessed."
Two services were hit. The Turing Scheme portal, which handles funding applications for international education programmes, was knocked offline, as was the DfE's online help desk. Both were expected to return to normal operation within days of the attack being discovered.
Should people affected be worried?
The official assessment is that the data-protection risk is low. Phone numbers and email addresses alone do not give criminals access to money or identity documents.
That said, anyone who has used either service should be alert to unexpected calls or emails claiming to be from the DfE or related education bodies. Criminals sometimes use stolen contact details to run follow-on scams, called phishing attacks, where they send convincing fake messages to trick recipients into handing over more valuable information. If a message feels off, contact the DfE directly through its official website rather than clicking any link in the message.
How is the government responding?
The DfE says it acted quickly once the breach was spotted and brought in two national agencies. The National Cyber Security Centre (NCSC), which is the UK government's technical authority on cyber threats, is advising on the response. The National Crime Agency (NCA) is investigating the criminal side. The DfE has also referred itself to the Information Commissioner's Office, meaning regulators will independently assess whether data-protection law was followed.
No group has publicly claimed responsibility. Attribution at this stage would be premature, and the DfE has not disclosed the attack method.
The wider picture
This incident sits inside a worrying trend. The UK government's own Cyber Security Breaches Survey found that around 24 percent of further education colleges reported a cyber-attack or breach at least once a week. More than half of UK schools reported an incident in the past year, as first covered by BBC News.
Education bodies hold large volumes of personal data and often run underfunded IT teams, a combination that makes them attractive targets.
| Detail | Figure |
|---|---|
| Records taken | ~607,000 |
| Data types stolen | Phone numbers, email addresses |
| Sensitive data (bank details, passwords) | None |
| Services affected | Turing Scheme portal, DfE help desk |
| Colleges reporting weekly attacks | ~24% |
| Schools reporting breach in past year | Over 50% |
