Social Engineering Attack on the Department for Education: What Social Care Providers Can Learn

The breach was claimed by a group calling itself ExfilSquad, and it appears records linked to the Turing Scheme – which helps UK students study overseas – were also caught up in the incident. Importantly, the 607,000 figure refers to entries on the system, not necessarily 607,000 different people.

Put simply: it’s manipulating people to do things that put security at risk.

Instead of fighting your technical defences, criminals target your team – and they’re good at it. They’ll try to talk someone into:

• Handing over information
• Resetting a password
• Sharing an authentication code
• Changing account settings
• Clicking a link or opening an attachment
• Or believing they’re a trusted colleague, supplier, or IT support worker

This is what makes it so dangerous. You can have the best firewalls and antivirus tools money can buy – but if someone is fooled into letting a criminal through the front door, all that technology counts for nothing.

The NCSC’s guidance on phishing and social engineering highlights how criminals use convincing communications to encourage people to disclose information, click malicious links or perform other actions that compromise security.

Phishing is the most well-known form: messages designed to trick you into sharing details or downloading harmful software. It can arrive by email, text, phone call, or even on social media – and it’s getting harder to spot.

This wasn’t a care provider that got hit – but every lesson here applies directly to you.

Care organisations hold huge amounts of information criminals would love to get their hands on:

• Names and contact details
• Staff and service user records
• Health and care information
• Financial details
• Safeguarding notes
• Passwords and login details
• Family and next-of-kin information
• Supplier and partner lists

You don’t need to have your main care database hacked for an attack to start. Even basic contact details – or information found on your website, social media, or in an old breach – is enough for criminals to build a convincing story.

Even “harmless” details can be dangerous

A name, job title and work email might not seem like a big deal. But piece them together with what’s on LinkedIn, your organisation’s website, or what’s been leaked elsewhere – and suddenly a scammer sounds like they know exactly what they’re talking about.

They can tailor every message, every call, every detail to sound like they belong. That’s what makes these attacks so hard to spot – and so effective.

This breach is a perfect chance to pause and review how you protect yourself – starting with these seven steps:

1. Check how you prove who someone is

Never trust just a name, email or phone number. For password resets, account changes or requests for sensitive information, have clear, fixed checks that go beyond basic details.

2. Look closely at your helpdesk and support rules

Ask yourself:

• Can someone ask for a password reset over the phone?
• What proof do they have to give?
• Can staff skip checks just because something sounds “urgent”?
• Can admins change details after a single call?
• Are powerful accounts checked more strictly?
• Do you keep a record of odd or unexpected requests?

Great IT systems mean nothing if your support processes are easy to get around.

3. Use multi-factor authentication (MFA) everywhere you can

MFA adds a second lock to your doors – even if someone’s password gets shared or stolen, they still can’t get in. Make it a priority for:

• Email accounts
• Microsoft 365 / Google Workspace
• Any system you log into from outside the office
• Administrator accounts
• Cloud tools
• Care management systems
• Anything holding personal or confidential information

4. Train your team to spot manipulation, not just dodgy emails

Cybersecurity training shouldn’t stop at “don’t click strange links”. People need to recognise when someone is trying to push them:

• Pressure to act right now
• Odd requests from senior staff
• Being told to skip the usual steps
• Unexpected password reset messages
• Asking for codes or login details
• Calls claiming to be from IT support
• Requests to change bank or payment details

The NCSC always says: don’t rely on one single thing to keep you safe – layer your protection.

5. Think twice about what you put online

Check what you publish about your team on your website or social media. You don’t have to take everything down – but ask: do people really need to see job titles, email addresses and full profiles? Could that information help someone pretend to be part of your organisation?

6. Keep a tight rein on who has access

Only give people the access they actually need to do their job. Regularly check:

• Who has administrator rights
• Accounts that haven’t been used in ages
• Logins for people who’ve left
• Outside agencies or suppliers who still have access
• Shared accounts (try to avoid these wherever possible)
• Your password rules
• A record of who used what, and when

This is called “least privilege” – and it’s one of your strongest safeguards.

7. Have a plan for when things go wrong

Everyone should know exactly what to do if someone says: “I think I just gave my password to a scammer.” Don’t try to work it out on the spot. Your plan needs to cover:

• Who to tell first
• How to lock down affected accounts
• How to reset passwords and cut off access
• What to keep as evidence
• When to bring in your Data Protection Officer
• When you need to tell regulators like the ICO
• How you’ll let people know if their information is involved

Having this ready means you can act fast – and stop a small problem turning into a major incident.

Share this with every member of your team: STOP, CHECK, CHALLENGE

• STOP: Don’t let urgency or pressure make you rush past your usual steps.
• CHECK: Find them yourself using a number or email address you already know is right – don’t use the details they gave you.
• CHALLENGE: If something feels off, ask questions. Take it to a manager. Any legitimate request will survive a quick check.

Anyone who works for you, supports you, or supplies you will understand why you’re being careful.

If you get something suspicious…

Don’t click links, open attachments, or share codes or passwords. Report it straight away using your organisation’s process – the sooner you speak up, the less damage is likely to happen. You can also forward suspicious emails to the NCSC’s reporting service to help protect others too.

This breach proves one thing: cybersecurity isn’t just an IT job. It’s people + processes + technology + good governance.

Firewalls and antivirus are vital – but you also need your team to understand how criminals think, and your day-to-day rules to stand up to being tested.

For social care providers, this matters more than most. A cyber incident doesn’t just mean lost money or downtime – it can put vulnerable people at risk, break trust with families, and mean you fall short of the standards you’re regulated to keep.

So don’t just ask: “Do we have security tools in place?”

Ask instead: “Would our people and our processes stand up to someone trying to trick their way in?”

UKAuthority

NCSC – Phishing: how to spot and report phishing scams

NCSC – Spotting cyber attacks and preparing your organisation

DfE – Data protection in schools: Managing breaches

DfE Cyber Security Hub – Cyber incident reporting guides