FUTURE NOT SET

Privacy | Security | Analysis | Investigation

| Enquiries:

| Telegram: futurenotset

[FUTURE NOT SET @Future_Not_Set]

@PolitlcsUK @billcurtis0 Same group [ExfilSquad] that breached DfE on or around 26th July:

https://t.co/yTPpyWN2A4

[FUTURE NOT SET @Future_Not_Set]

607,000 records pulled from two systems: Turing Scheme & Help Desk portals.

Names, e-mail addresses, phone numbers, job titles of education sector contacts incl. govt officials.

And just *how* is a national digital ID system viable with such serious breaches?

[FUTURE NOT SET @Future_Not_Set]

@TheBernician @OffGuardian0 And sadly, Michael, this is the same Act that remains on the statute book. However 'powered-down' it might be.

[FUTURE NOT SET @Future_Not_Set]

Full story from @guardian

https://t.co/d0dELUWmcH

[FUTURE NOT SET @Future_Not_Set]

Not a good week for Data Breach Britain.

- Dept. for Education: 607,000 records pulled from two portals incl. details of govt officials.

- UKGI: 51 govt officials details left exposed for 40hrs.

Cybersecurity resilience must be the #1 priority, not One Login centralisation.

[FUTURE NOT SET @Future_Not_Set]

- Britons don't like centralised state identity systems
- Britons don't like National ID
- The state has had at least 20 years to modernise infrastructure & strengthen cybersecurity

- The state dream of modern digital governance is not achievable

https://t.co/uxZskLELWS

[FUTURE NOT SET @Future_Not_Set]

@AllisonPearson And power-mad women like Michie who wanted face-coverings forever.

[PublicTechnology @PublicTech]

The Department for Education has referred itself to the Information Commissioner’s Office after hackers gained access to hundreds of thousands of lines of information in a cyberattack.
Story ⬇️
https://t.co/dysS633WxQ

[FUTURE NOT SET @Future_Not_Set]

You can read the committee report here:

https://t.co/GVw8QukuUZ

[FUTURE NOT SET @Future_Not_Set]

Key findings:

- Data breach not discovered for 1.5 years
- Data breach was preventable
- Extraordinary secrecy used by HMG
- Not simply human error: poor systems, weak oversight

A public interest existed & the public should have been informed a breach had occurred.

[FUTURE NOT SET @Future_Not_Set]

Attacks keep on coming because the crims keep getting hits & using pulled data for secondary attacks.

The painful truth is that the govt haven't learned from past mistakes yet want to modernise digital services. It's dangerous and it's going to cost the public dearly.

[FUTURE NOT SET @Future_Not_Set]

They're not just soft targets, they're high-value targets.

Imagine a scenario where One Login is integrated with DfE on an identity verification level using SSO.

You're looking at an even greater risk of compromise & larger blast surface potentially impacting multiple depts.

[FUTURE NOT SET @Future_Not_Set]

@richimedhurst Looking forward to the bible, Richie 🫡

[FUTURE NOT SET @Future_Not_Set]

@PoliticsTheory1 @GuidoFawkes Likely. DfE have confirmed, but not officially through govt comms

[FUTURE NOT SET @Future_Not_Set]

@Footgolfexpert @GuidoFawkes

[FUTURE NOT SET @Future_Not_Set]

@totti99city @GuidoFawkes @Dominic2306 They didn't lose the records. They were nicked.

[FUTURE NOT SET @Future_Not_Set]

The ransomware group 'ExfilSquad' also claim to have parent and staff contact records from the Help Desk portal at DfE.

[FUTURE NOT SET @Future_Not_Set]

607,000 records pulled from two systems: Turing Scheme & Help Desk portals.

Names, e-mail addresses, phone numbers, job titles of education sector contacts incl. govt officials.

And just *how* is a national digital ID system viable with such serious breaches?

[FUTURE NOT SET @Future_Not_Set]

@DarrenPlymouth Of course it won't. Digital ID [verification] has been used combined in both the UK private & public sector for 10+ years and it hasn't prevented breaches. In fact, it could increase the threat surface for them.

[FUTURE NOT SET @Future_Not_Set]

DfE et al are attempting to play down about containment, but from what we've seen so far, there's a lot of other linkable PII involved in the datasets.

[FUTURE NOT SET @Future_Not_Set]

🚨BREAKING: The UK Department for Education was hacked by the ransomware group 'ExfilSquad' on July 26th.

Some 600,000 contact records are said to have been affected containing PII such as names, emails, phone numbers.

[FUTURE NOT SET @Future_Not_Set]

https://t.co/i7Lcz6s7gb

[FUTURE NOT SET @Future_Not_Set]

@grok @devteamdrew @PolitlcsUK @billcurtis0 It has been confirmed. You said earlier it was 'unconfirmed'.