The Department for Education (DfE) has confirmed that approximately 607,000 records were accessed during a recent cyber attack, underlining the increasing threat posed by cyber criminals to public sector organisations.

According to the DfE, the compromised data primarily consisted of contact information, including email addresses and telephone numbers linked to individuals and organisations. The department stated that no bank details or other highly sensitive personal information were accessed during the incident.

The attack affected systems associated with the Turing Scheme, the UK’s international education funding programme, as well as the department’s online help desk services. Officials indicated that the disruption was contained quickly and that normal service was expected to resume shortly.

In response to the breach, the DfE has been working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) to investigate the incident and assess its impact. The department has also notified the Information Commissioner’s Office (ICO), in line with data protection requirements.

The DfE stressed that the reported figure of 607,000 relates to records rather than individual people, and that the overall risk to affected individuals is currently considered to be low.

Education Sector Remains a Growing Target

The incident comes amid ongoing concerns about cyber security across the education sector. Government research has shown that cyber attacks against schools, colleges and universities continue to rise, with many organisations reporting breaches or attempted attacks over the past year.

Educational establishments often manage significant volumes of personal data and operate complex digital infrastructures, making them attractive targets for cyber criminals. The increasing reliance on digital services, cloud platforms and online learning tools has further expanded the potential attack surface for malicious actors.

Key Lessons for Organisations

While the DfE reported that sensitive financial data was not compromised, the incident serves as a reminder that even seemingly routine information such as contact details can hold value for cyber criminals. Stolen data can be used to support phishing campaigns, social engineering attacks and other forms of fraud.

Organisations should consider:

  • Regularly reviewing access controls and user permissions.
  • Ensuring robust monitoring and incident response procedures are in place.
  • Providing ongoing cyber awareness training for staff.
  • Maintaining up-to-date security patches and vulnerability management programmes.
  • Testing business continuity and cyber incident response plans.

As cyber threats continue to evolve, organisations across both the public and private sectors must remain vigilant and invest in proactive security measures to reduce the likelihood and impact of future attacks.

How TIAA Can Help

TIAA’s Cyber Security team supports clients in strengthening their cyber resilience through a range of services, including Cyber Health Checks, penetration testing, vulnerability assessments, Cyber Essentials certification support, incident response planning and staff awareness training. By identifying weaknesses before attackers do and helping organisations implement proportionate security controls, TIAA enables clients to reduce risk, improve compliance and respond effectively to emerging cyber threats.

Find out more about TIAA’s Cyber Security services by contacting our team today.

Source: BBC News reporting on the Department for Education cyber incident, published 29 July 2026.