ExfilSquad Leaks Alleged Wesco CRM Data After Extortion Attempt

Wesco said it is investigating a cybersecurity incident after the extortion group ExfilSquad claimed to have stolen and leaked company data. The company said the incident was limited to its cloud CRM environment, was detected quickly, caused no business disruption, and showed no evidence of ransomware or other malware on internal IT systems. Wesco also said it does not believe sensitive customer or employee information, including payment card and financial account data, is at risk.

ExfilSquad claimed it exfiltrated 2.6 million records and released the data after ransom negotiations did not take place. The group said the leak includes customer and employee PII, account and contact records, CRM user profiles, credit and business identifiers, authentication metadata, and access-related information, and researchers have previously linked ExfilSquad intrusions to improperly configured Microsoft Power Pages data tables. Public reporting noted that Wesco may use Microsoft Dynamics 365, suggesting the incident may involve exposed cloud CRM components rather than malware-driven network compromise.