ExfilSquad

ExfilSquad, also known as Exfil Squad and exfil_squad, is a financially motivated cybercriminal data-extortion group first publicly observed in July 2026. It targets organizations across government, education, law enforcement, technology, financial services, industrial distribution, transportation, and retail. Its activities have affected organizations in the United Kingdom, United States, and Sweden. Named targets include the UK Department for Education, the Police National Legal Database, Newcastle University, and the municipal governments of Atlanta and Houston. The group's documented campaign centers on unauthorized data access through misconfigured cloud and SaaS applications, particularly Microsoft Power Pages portals connected to Dynamics 365 and Dataverse. Overly permissive table permissions can allow unauthenticated visitors to retrieve sensitive records without exploiting a software vulnerability or compromising an internal network. Exposed information includes employee and customer contact details, resident service requests, and other CRM and case-management records. Newcastle University confirmed unauthorized access through a configuration flaw but disputed the scope of the group's claims. ExfilSquad demands payment under threat of publication, using a Tor-hosted leak site, public victim listings, and negotiation deadlines. It has distributed leaked datasets through torrents, including victim-specific trackers and web seeds. Its established model is data-theft-only extortion; there is no confirmed deployment of file-encrypting ransomware. Some listings and claimed breach scopes remain unverified, and published samples do not necessarily demonstrate broader network or tenant compromise.