--- title: "Cyber Attackers Take 607,000 Records From the D… | Firevault" url: https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026 description: "Around 607,000 records were taken in a cyber attack on the Department for Education in England, affecting the Turing Scheme portal and the departmental help…" lang: en-GB --- News · Breach Analysis · 29 July 2026 # Cyber Attackers Take 607,000 Records From the Department for Education Around 607,000 records were taken in a cyber attack on the Department for Education in England, affecting the Turing Scheme portal and the departmental help desk. The incident lands in a sector where more than half of schools reported an attack or breach in the past year. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 3 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdfe-cyber-attack-607000-records-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdfe-cyber-attack-607000-records-2026&text=Cyber%20Attackers%20Take%20607%2C000%20Records%20From%20the%20Department%20for%20Education%0A%0AAround%20607%2C000%20records%20were%20taken%20in%20a%20cyber%20attack%20on%20the%20Department%20for%20Education%20in%20England%2C%20affecting%20the%20Turing%20Scheme%20portal%20and%20the%20departmental%20help%20desk.%20The%20incident%20lands%20in%20a%20sector%20where%20more%20than%20half%20of%20schools%20reported%20an%20attack%20or%20breach%20in%20the%20past%20year. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fdfe-cyber-attack-607000-records-2026 Image: Empty school corridor with lockers overlaid with a digital data grid, representing the Department for Education data breach (https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg) Empty school corridor with lockers overlaid with a digital data grid, representing the Department for Education data breach Why it matters ## What this means for organisations holding critical data **Hackers have obtained approximately 607,000 records** in a cyber attack on the Department for Education (DfE) in England, as first reported by the BBC (https://www.bbc.co.uk/news/articles/cq6dmgrp21po). The department has confirmed the incident and is working with the National Cyber Security Centre and the National Crime Agency. ## What Happened The data taken includes telephone numbers and email addresses relating to individuals and organisations. According to the DfE, it does not include bank details or other sensitive information. The department states that the 607,000 figure relates to the total number of records affected rather than the number of individuals. Two services were affected: the Turing Scheme portal, which administers funding for international education, and the DfE online help desk. Both were expected to return to normal operation within the week. The DfE has referred itself to the Information Commissioner's Office. A DfE spokesperson said: "We have robust processes in place to protect information and took swift action to contain this incident. The information involved is limited to customer service contact details relating to individuals and organisations. No other data has been accessed." A National Crime Agency spokesperson said: "We are aware of an incident affecting the Department for Education and are working with partners to understand the circumstances and impact." ## Why It Matters Contact details are often described as low-risk data. In practice they are the raw material of the next attack. A verified list of email addresses and telephone numbers belonging to schools, colleges, scheme administrators and the people who work with them is a ready-made targeting list for phishing, smishing and impersonation of the department itself. Attackers who can credibly appear to be the DfE help desk have a very short route into school systems that hold far more sensitive records. The scale also matters. Six hundred and seven thousand records is not an edge case in an obscure system. It is a central government department losing a large volume of operational contact data from services that the education sector is required to use. ## The Wider Education Picture Education is now one of the most heavily targeted sectors in the United Kingdom. The government's Cyber Security Breaches Survey 2025 to 2026 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026-education-institutions-findings) found that around a quarter of further education institutions (24 per cent) experienced a breach or attack at least weekly, and that more than half of schools reported an attack or breach in the past year. The threat is not only external. The Information Commissioner's Office has warned that children are hacking their own schools (https://www.bbc.co.uk/news/articles/c203pedz58go), often for status or entertainment rather than money, using credentials that are shared, guessed or simply watched over a shoulder. ## The Firevault View Every service that must stay online will eventually be probed, and some of those probes will succeed. The question that matters for a department, a trust or a single school is what remains recoverable and unreadable when that happens. Offline Secure Storage (https://fire-vault.com/offline-secure-storage) answers that question at Layer 1. Records placed in an offline vault are physically disconnected from the network, so they cannot be read, altered, encrypted or exfiltrated by an attacker who is already inside an online estate. Safeguarding files, special educational needs records, pupil photographs, historic admissions data and governance papers do not need to be permanently reachable from the internet in order to be useful. For a practical checklist aimed at schools and trusts, read our briefing on safeguarding education data in schools, colleges and universities (https://fire-vault.com/news/guide-safeguarding-education-data). ## Sources - BBC News, "Cyber-attackers take 607,000 records from Department of Education" (https://www.bbc.co.uk/news/articles/cq6dmgrp21po) - Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025 to 2026: education institutions findings (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026-education-institutions-findings) About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026#webpage", "url": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026", "name": "Cyber Attackers Take 607,000 Records From the D…", "description": "Around 607,000 records were taken in a cyber attack on the Department for Education in England, affecting the Turing Scheme portal and the departmental help…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Cyber Attackers Take 607,000 Records From the Department for Education", "item": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Cyber Attackers Take 607,000 Records From the Department for Education", "description": "Around 607,000 records were taken in a cyber attack on the Department for Education in England, affecting the Turing Scheme portal and the departmental help desk. The incident lands in a sector where more than half of schools reported an attack or breach in the past year.", "url": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/hero-images/dfe-education-breach-2026-vibrant.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-07-29T19:47:51.792663+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/dfe-cyber-attack-607000-records-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 593, "keywords": "Cyber, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Hackers have obtained approximately 607,000 records in a cyber attack on the Department for Education (DfE) in England, as first reported by the BBC . The department has confirmed the incident and is working with the National Cyber Security Centre and the National Crime Agency. What Happened The data taken includes telephone numbers and email addresses relating to individuals and organisations. Ac", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How many records were taken in the Department for Education cyber attack?", "acceptedAnswer": { "@type": "Answer", "text": "Around 607,000 records were obtained. The department states that this figure refers to the total number of records affected rather than the number of individuals." } }, { "@type": "Question", "name": "What type of data was involved?", "acceptedAnswer": { "@type": "Answer", "text": "Telephone numbers and email addresses relating to individuals and organisations. The Department for Education states that bank details and other sensitive information were not included." } }, { "@type": "Question", "name": "Which services were affected?", "acceptedAnswer": { "@type": "Answer", "text": "The Turing Scheme portal, which provides funding for international education, and the Department for Education online help desk." } }, { "@type": "Question", "name": "Why does a contact data breach still matter?", "acceptedAnswer": { "@type": "Answer", "text": "Verified contact details give attackers a targeting list for phishing and impersonation. A message that appears to come from the department is far more likely to succeed against a school inbox than a generic scam." } } ] } ] ```