DfE has confirmed a cyber attack on its helpdesk and Turing Scheme portal systems, affecting around 607,000 records — names, job titles, emails and phone numbers, with no financial data taken. DfE has referred itself to the ICO and is working with the NCSC and NCA. Schools don’t need to report this themselves unless they suffer a related breach of their own systems. The main practical risk is phishing that references DfE or the Turing Scheme. See below for what to watch for and how to prepare staff.

The Department for Education (DfE) has confirmed a cyber attack affecting around 607,000 records held on its systems. Here’s what’s actually been confirmed, and what a DfE data breach means for your school, and practical steps to protect staff from phishing risk.

means practically for schools.

What happened

The attack targeted two DfE-run services: the department’s online helpdesk, used by school and university staff and local authorities to get support, and the Turing Scheme portal, which administers funding for international education placements.

A group calling itself ExfilSquad has claimed responsibility. According to DfE’s own statements, the data taken included names, job titles, email addresses and phone numbers belonging to school leaders, university staff, and government officials who had contacted these services.

What wasn’t taken

DfE has confirmed that no financial details were included in the compromised data. Both affected services were taken offline as part of the department’s containment response.

DfE’s response

DfE has referred the incident to the Information Commissioner’s Office (ICO) and is working with the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) as investigations continue. At the time of writing, DfE has not confirmed a return date for the helpdesk or Turing Scheme portal.

What this means for schools

The data exposed here is contact information, not financial or safeguarding data. But names, job titles, email addresses and phone numbers are exactly what’s needed to make a phishing email or phone call look credible — particularly one impersonating DfE. This is worth taking seriously even though the underlying data is relatively low-sensitivity.

DfE’s own Cyber Security Hub notes that phishing is already involved in the large majority of cyber incidents reported by schools, so this breach adds a specific, current pretext attackers may use, rather than introducing a new category of risk.

What schools should be doing now

• Brief staff, particularly anyone who has used the DfE helpdesk or Turing Scheme portal in recent months, that emails or calls referencing DfE services should be treated with caution if they ask for action, credentials, or payment.
• Verify independently. Any communication claiming to be from DfE that requests login details, payment, or software installation should be checked via contact details from gov.uk directly — not the ones provided in the message itself.
• Review MFA coverage, especially for email and finance systems, as a general precaution against credential-based follow-up attacks.
• Remind staff not to feel pressured. A legitimate DfE request will not require urgent, unverified action — it’s reasonable to pause and check.
• Keep an eye on DfE’s Cyber Security Hub for official updates as the investigation develops.

What to watch out for

These are general phishing/social-engineering patterns worth being alert to, not confirmed tactics tied to this specific breach:

• Emails referencing DfE, the helpdesk, or the Turing Scheme that ask you to click a link, log in, or “verify” details urgently.
• Phone calls claiming to be DfE IT support or asking to “confirm” account or contact details — DfE has not indicated it is contacting schools by phone about this incident.
• Requests to download software, security tools, or “updated guidance” via email attachment or link.
• Messages that create time pressure (“respond within 24 hours” / “your account will be suspended”) — a common social-engineering tactic regardless of the sender claimed.
• Anything asking your IT provider or MSP to make changes on your behalf without your own verification.

Quick checklist

• Staff briefed on the breach and what a suspicious DfE-related email or call might look like
• A clear internal point of contact named for staff to forward suspicious messages to
• MFA confirmed as enabled on email and finance systems
• Staff who used the DfE helpdesk or Turing Scheme portal identified for a more specific heads-up
• DfE’s Cyber Security Hub bookmarked for updates
• No independent ICO report needed unless your own systems are subsequently affected

Frequently asked questions

Was my school’s data part of the DfE breach? Only if your school contacted the DfE helpdesk or used the Turing Scheme portal — the breach affected users of those two specific services, not a general database of all schools. DfE hasn’t published a way for schools to check individually.

What data was stolen in the DfE data breach? Names, job titles, email addresses and phone numbers. DfE has confirmed no financial details were taken.

Do schools need to report the DfE breach to the ICO? No — DfE is the data controller for its own systems and is responsible for its own ICO notification regarding this incident. A school would only need to make its own report if it subsequently suffered a related breach of its own systems, for example as the result of a successful phishing attempt referencing this incident.

Is the DfE helpdesk or Turing Scheme portal back online? As of the time of writing, DfE has not confirmed a return date for either service. Check DfE’s Cyber Security Hub or gov.uk for the latest status.

Who is behind the DfE cyber attack? A group calling itself ExfilSquad has claimed responsibility. This hasn’t been independently verified beyond DfE and press reporting.

If you’d like a second opinion on your school’s phishing defences or verification protocols, DMS is happy to have a no-obligation conversation.