Loading story…
Wesco said it is investigating a cybersecurity incident after the extortion group ExfilSquad claimed to have stolen and leaked company data. The company said the incident was limited to its cloud CRM environment, was detected quickly, caused no business disruption, and showed no evidence of ransomware or other malware on internal IT systems. Wesco also said it does not believe sensitive customer or employee information, including payment card and financial account data, is at risk.
ExfilSquad claimed it exfiltrated 2.6 million records and released the data after ransom negotiations did not take place. The group said the leak includes customer and employee PII, account and contact records, CRM user profiles, credit and business identifiers, authentication metadata, and access-related information, and researchers have previously linked ExfilSquad intrusions to improperly configured Microsoft Power Pages data tables. Public reporting noted that Wesco may use Microsoft Dynamics 365, suggesting the incident may involve exposed cloud CRM components rather than malware-driven network compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Resecurity reported that ExfilSquad was targeting additional victims and distributing stolen data through torrents, adding technical and operational detail about the group's extortion activity.
Wesco said it is investigating a cybersecurity incident involving its cloud CRM environment after becoming aware of a third-party claim of CRM data exfiltration. The company said it detected the issue quickly, found no evidence of ransomware or other malware on its IT systems, and saw no business disruption.
ExfilSquad claimed it stole 2.6 million Wesco records, including customer and employee PII, CRM user profiles, and authentication-related data. The group said it published the data after ransom negotiation deadlines expired.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceresecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 12, 2026
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026
Cloud marketplace and distributor **Pax8** confirmed an accidental data leak after an internal spreadsheet/CSV containing sensitive business information was mistakenly emailed to fewer than **40 UK-based partners**. The file—titled **"Potential Business Premium Upgrade Tactic to Save Money"**—was sent on January 13 by a strategic account manager and included details that recipients said exposed **MSP customer organization names** and **Microsoft licensing information** (e.g., **SKUs**, license counts, and *New Commerce Experience (NCE)* renewal dates). Pax8 attempted to recall the email and followed up asking recipients to delete the message and attachment. Artifacts reviewed by reporting indicated the dataset contained **56,000+ entries** and fields such as partner/customer names and IDs, product/vendor details, bookings, quantities, territory/account owner, provision/cancellation dates, transaction type, commitment term end date, and postal code. Pax8 stated the file did not include **personally identifiable information (PII)**, but it did expose commercially sensitive intelligence (pricing/program and partner management data) affecting roughly **1,800 partners** (primarily UK-based, with one noted in Canada). Industry sources cited in coverage warned that **threat actors are attempting to acquire the dataset**, raising risks of competitive targeting, phishing, and extortion using exposed customer and licensing context.
Jun 29, 2026