Loading story…
Cloud marketplace and distributor Pax8 confirmed an accidental data leak after an internal spreadsheet/CSV containing sensitive business information was mistakenly emailed to fewer than 40 UK-based partners. The file—titled "Potential Business Premium Upgrade Tactic to Save Money"—was sent on January 13 by a strategic account manager and included details that recipients said exposed MSP customer organization names and Microsoft licensing information (e.g., SKUs, license counts, and New Commerce Experience (NCE) renewal dates). Pax8 attempted to recall the email and followed up asking recipients to delete the message and attachment.
Artifacts reviewed by reporting indicated the dataset contained 56,000+ entries and fields such as partner/customer names and IDs, product/vendor details, bookings, quantities, territory/account owner, provision/cancellation dates, transaction type, commitment term end date, and postal code. Pax8 stated the file did not include personally identifiable information (PII), but it did expose commercially sensitive intelligence (pricing/program and partner management data) affecting roughly 1,800 partners (primarily UK-based, with one noted in Canada). Industry sources cited in coverage warned that threat actors are attempting to acquire the dataset, raising risks of competitive targeting, phishing, and extortion using exposed customer and licensing context.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Pax8 confirmed that the mistakenly emailed spreadsheet exposed sensitive business information to fewer than 40 UK-based partners and stated that no personally identifiable information was included. Public reporting on January 14-15, 2026, detailed the scope of the exposed customer and Microsoft licensing data.
By the time the incident was reported publicly, industry sources said threat actors were approaching some affected MSPs to buy copies of the leaked spreadsheet. The data was seen as potentially useful for competitive intelligence, phishing, business email compromise, or extortion tied to renewal dates.
After discovering the mistaken disclosure, Pax8 attempted to recall the email, contacted recipients directly, and asked them to delete the message and attachment while confirming they had not forwarded it. The company also said it launched an internal review to prevent a recurrence.
On 2026-01-13, a Pax8 EMEA strategic account manager sent an email titled “Potential Business Premium Upgrade Tactic to Save Money” to fewer than 40 UK-based MSP partners with an attached CSV containing internal business data. The spreadsheet reportedly included more than 56,000 entries covering MSP customer organization names, Microsoft licensing details, pricing information, and program management data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wesco said it is investigating a cybersecurity incident after the extortion group **ExfilSquad** claimed to have stolen and leaked company data. The company said the incident was limited to its cloud CRM environment, was detected quickly, caused no business disruption, and showed no evidence of ransomware or other malware on internal IT systems. Wesco also said it does not believe sensitive customer or employee information, including payment card and financial account data, is at risk. ExfilSquad claimed it exfiltrated **2.6 million records** and released the data after ransom negotiations did not take place. The group said the leak includes customer and employee PII, account and contact records, CRM user profiles, credit and business identifiers, authentication metadata, and access-related information, and researchers have previously linked ExfilSquad intrusions to improperly configured **Microsoft Power Pages** data tables. Public reporting noted that Wesco may use **Microsoft Dynamics 365**, suggesting the incident may involve exposed cloud CRM components rather than malware-driven network compromise.
Aug 12, 2026
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026
The consumer spyware services **Cocospy** and **Spyzie** suffered breaches that exposed large volumes of customer data and reportedly opened access to highly sensitive information collected from monitored devices. According to breach disclosures added to **Have I Been Pwned**, the Cocospy incident exposed nearly **1.8 million** customer email addresses, while the Spyzie breach exposed about **519,000** email addresses; related spyware service **Spyic** was also reported as affected. The compromised data reportedly included not only customer records but also victim information gathered by the spyware platforms, including captured messages, photos, and call logs. Because of the sensitivity of the incident, the exposed email addresses were provided to HIBP but were classified as **sensitive**, meaning they are not publicly searchable through the service.
Jun 29, 2026