A previously unknown hacking group called ExfilSquad has claimed responsibility for separate breaches of the Police National Legal Database (PNLD) and the Department for Education (DfE) help-desk portal, posting data samples from both on its leak site and demanding payment from each organisation. The PNLD, hosted by West Yorkshire Police, confirmed that 135,000 pieces of data were exposed, while the DfE breach compromised over 600,000 lines of data, according to a report by The Guardian on July 29, 2026, which credited The Times as the first outlet to break the DfE story The Guardian.

The PNLD breach exposed police officer names, force or organisation affiliations, and work email addresses. Also caught in the spill were names and addresses of members of the public who had used the Ask the Police service, a public-facing Q&A resource. The PNLD stated that the database did not hold confidential victim, witness, or offender information, drawing a perimeter around what was and was not exposed. The DfE intrusion, by contrast, targeted the department's help-desk portal and yielded parent and staff contact records: full names, email addresses, phone numbers, and job titles.

ExfilSquad's operational signature is consistent with the double-extortion model that has become standard among ransomware and data-theft crews. Data is exfiltrated first, samples are published on a leak site as proof, and a ransom demand follows, with the implicit or explicit threat of releasing the full dataset if payment is not made. Both the DfE and the PNLD were named as targets of the demand. The group had no prior public profile before these claims.

The Guardian's report cites a statement from the PNLD but does not include or reference an official statement from the DfE itself. This asymmetry in institutional response is worth noting. A police-hosted database acknowledging a breach involving officer identifiers carries immediate operational security implications, and the PNLD's decision to clarify that no victim, witness, or offender data was held in the compromised system appears designed to contain the damage to administrative and contact-level records rather than investigative material.

The DfE exposure presents a different risk calculus. Over 600,000 lines of parent and staff contacts, including phone numbers and job titles, are precisely the kind of data that lends itself to phishing, social engineering, and secondary compromise campaigns. Help-desk portals are a well-documented weak point in public-sector infrastructure; they sit at the intersection of high user volume, legacy authentication, and frequently third-party hosting, and they process identity-adjacent data that rarely receives the same access controls as core departmental systems.

Looking at what this means for the broader landscape, two elements stand out. First, the targeting of both a police-adjacent system and a central government department by the same actor, with simultaneous extortion demands, suggests a coordinated campaign rather than opportunistic exploitation. Whether ExfilSquad is a genuinely new group or a rebrand of an existing operation is an open question that the absence of any prior track record does not resolve. Second, the breach of the PNLD, even limited to administrative data, touches a category of systems that UK policing has historically treated as low-sensitivity because they sit outside case management and evidence chains. The exposure of officer names, force affiliations, and work emails challenges that classification. Correlating an officer's name and force with publicly available duty rosters, social media, or court records can produce a operational profile that adversaries can exploit.

The lack of a DfE statement in the public record, as of The Guardian's July 29 report, leaves open the question of how the department is responding to affected individuals and whether remediation extends beyond the help-desk portal itself. The PNLD's acknowledgement, while limited in scope, at least establishes a public baseline for what was compromised.