What has happened?
The Department for Education (DfE) has told NASUWT that a third party gained access to its Customer Help Portal and Turing Scheme Portal.
The DfE says that data from these portals has been published online. The DfE says the incident only affects people who contacted it through one of these portals.
The information may include names, job titles, email addresses, phone numbers and business addresses. The DfE’s current list does not include passwords or bank details.
This information comes from the DfE’s data security incident page and its communications with the Union.
The DfE has confirmed that it notified the Information Commissioner’s Office (ICO).
BBC News has reported that the DfE is also working with the National Cyber Security Centre (NCSC) and the National Crime Agency (NCA).
What NASUWT members should do
The NCSC’s advice for people affected by a data breach says that you should be alert to suspicious emails, texts, calls and websites. Criminals may use real information about you to make a message appear genuine.
If you need to check whether you have been affected, following NCSC advice, you should contact the DfE through its official website. Do not use links or contact details in an unexpected message.
The NCSC warns that suspicious callers may ask for passwords, bank details or access to your computer. Do not provide this information in response to an unexpected message or call.
If a suspicious message contains a password that you still use, the NCSC advises changing it.
You should also change your password on any other account where you have used the same password.
Check your online accounts for activity that you do not recognise.
Reporting suspicious messages or fraud
Following the NCSC’s guidance on reporting phishing, suspicious emails can be forwarded to [email protected]. Suspicious text messages can be forwarded to 7726.
If you receive a suspicious call, hang up. Contact the organisation using a telephone number that you have checked independently.
If you have lost money, contact your bank immediately or Report Fraud.
Contacting the Union
Please email the Education Team if you have been told that your information was affected, received a suspicious message, suffered financial loss or distress or are worried about what has happened.
Keep any notification you receive from the DfE. Also keep suspicious messages and a note of any costs, loss or other effects of the incident.
Please do not send the Union passwords, security codes or copies of information published following the breach. Information sent to us will be handled in line with our privacy policy.
Please keep any notification from the DfE and any suspicious messages you receive. This will help us understand the effect on members and inform our response.
Making a complaint
The ICO says that you can complain directly to an organisation if you believe it has not followed data protection law. You should keep a copy of your complaint and any response.
Members who are considering making a complaint can contact the Union for advice about their individual position.
What the Union is doing
We are seeking more information from the DfE about the incident, how members will be identified and contacted, and what further protection and support will be provided.
We will update this advice when more information becomes available.