A previously unknown hacking group calling itself ExfilSquad has claimed responsibility for stealing 135,000 records from the Police National Legal Database (PNLD) and around 607,000 records from the Department for Education (DfE), posting samples of both datasets on a dark web leak site on 26 July 2026. The two claims form part of a wider spree in which the group listed 14 alleged victims across five countries on the same day, though most of those claims, including one involving Microsoft, remain independently unverified.
PNLD, which supplies legal guidance to all 43 Home Office police forces in England and Wales, said the exposed data included names, employing forces and work email addresses of officers and criminal justice staff, alongside some names and addresses of members of the public who had used its 'Ask the Police' service. The DfE said the stolen records were customer service contact details, including names, job titles, email addresses and phone numbers, taken from its Help Desk Self-Service Portal and Turing Scheme Portal.
