A new ransomware group is threatening to leak contact details of over 100,000 UK police officers after stealing data from government departments, including the Ministry of Defence (MoD), the Home Office, the National Crime Agency (NCA), and the Crown Prosecution Service (CPS).

The Times confirmed that a dark web listing from the group, known as ExfilSquad, in late July was legitimate, and that it had leaked the full names, email addresses, area of work details, and more, of over 100,000 staff listed on the Police National Legal Database (PNLD).

Police revealed that the data of 114,000 PNLD subscribers were leaked, and that most of these individuals were police officers.

The leak also included data from 2,615 CPS staff, 617 Home Office employees, 588 NCA staff and 402 MoD personnel

In all, ExfilSquad claimed to have hacked 15 firms and government bodies, including Microsoft and the UK’s Department for Education.

It had claimed that 135,000 law enforcement records were stolen, but the validity of these claims was reportedly doubted by researchers when it was listed.

🚨 ExfilSquad, an emerging ransomware group, has claimed responsibility for attacks against major enterprises and public sector organizations worldwide — Reported by #TEAM_D4rkn3ttz @jzzzz1qw

⚠️ Claimed victims:
– Wesco International
– Microsoft
– Allstate
– TaylorMade & Sun… pic.twitter.com/2ey0OPlYZi

— Team D4rkn3ttz (@Team_D4rkn3ttz) July 27, 2026
Details of the dark web listing that was doubted by researchers.

The ExfilSquad page reads, “Once your company’s data is posted here, it’s NEVER leaving the public eye and it will be passed around the internet FOREVER. The payment we request of you is simply a rounding error compared to the litigation costs of your data leaking. Be smart and just pay.”

Hacked firms were given until August 5 to contact ExfilSquad, with The Times reporting that the hack appears to be financially rather than politically motivated.

ExfilSquad will likely demand a cryptocurrency-based ransom as, like most ransomware and hacker groups, it can move the crypto into mixers, privacy coins, and unregulated exchanges in order to launder the stolen gains.

Iranian hacking collective CyberAv3ngers, which allegedly disrupted the services of 30 Minnesota water firms last week, has previously tried to sell illegally obtained data for BTC.

The UK is currently planning to ban public sector bodies from paying ransomware groups in a bid to make hacking government bodies unattractive for criminals.

Leaked data from these attacks can be used in a variety of ways to orchestrate targeted attacks against officials. Indeed, in 2025, a French tax official was arrested after she was found to have used government software to leak the data of prison officials and crypto specialists to criminals.

A court later denied her request to be released from prison after she tried to argue that she didn’t know who the criminals were.