Loading story…
ExfilSquad, a newly identified data extortion group, has leaked 382.64 GB of uncompressed data containing roughly 27 million records from 13 organizations after claiming a total of 15 victims. The group surfaced on the dark web in late July and initially posted victim names without proof before releasing sample datasets and later full archives. Reported victims include Microsoft, Allstate, Frontier Airlines, the City of Houston, the City of Atlanta, and multiple education and public-sector entities.
Threat intelligence from Fortra indicates the activity was most likely enabled by misconfigured Microsoft Power Pages portals that exposed Microsoft Dataverse data through the /_api/ interface, rather than a flaw in Dynamics 365 itself. Researchers identified more than 10,000 potentially exposed Power Pages instances, and said the Power Pwn tool was likely used to automate discovery. The group reportedly used infrastructure including IP address 209.99.188.199, the anonymous file-sharing domain u.pone.rs, and a consistent archive naming pattern of [victim]_exfilsquad.7z for leaked data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Fortra's FIRE team published a threat intelligence analysis on 13 August 2026 examining ExfilSquad's activity. The report assessed that the likely intrusion vector was misconfigured Microsoft Power Pages portals exposing Dataverse data via the /_api/ interface rather than exploitation of a Microsoft D365 software vulnerability.
ExfilSquad released another tranche of sample data on 7 August 2026. The additional disclosure further substantiated the group's claimed compromises.
After skepticism about its initial claims, ExfilSquad published sample data to support its victim claims. This first sample release occurred on 28 July 2026.
ExfilSquad emerged on the dark web on 26 July 2026 and launched a Tor-based leak site. At launch, the group claimed to have compromised 15 organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat reporting says the **ExfilSquad** group has been targeting misconfigured **Microsoft Power Pages** portals to access data exposed through the platform’s built-in Web API. Power Pages uses the `/_api` route to perform create, read, update, and delete operations against **Microsoft Dataverse** tables, and Microsoft documents that access is governed by per-table enablement, field-level controls, table permissions, column permissions, web roles, and CSRF protections. If those controls are improperly configured, portal data can become accessible in ways administrators did not intend. Microsoft’s documentation shows that the API is designed for portal user experiences and requires explicit configuration for each table and field, including use of the correct `EntitySetName` in requests. The guidance also notes that unsupported tables are blocked and that missing mandatory field settings can produce the error **"No fields defined for this entity"**, underscoring how heavily security depends on correct setup. The reported activity highlights a familiar cloud risk: attackers are abusing exposed functionality rather than a newly disclosed software flaw, making Power Pages permission reviews and API exposure checks a priority for defenders.
Aug 3, 2026
Wesco said it is investigating a cybersecurity incident after the extortion group **ExfilSquad** claimed to have stolen and leaked company data. The company said the incident was limited to its cloud CRM environment, was detected quickly, caused no business disruption, and showed no evidence of ransomware or other malware on internal IT systems. Wesco also said it does not believe sensitive customer or employee information, including payment card and financial account data, is at risk. ExfilSquad claimed it exfiltrated **2.6 million records** and released the data after ransom negotiations did not take place. The group said the leak includes customer and employee PII, account and contact records, CRM user profiles, credit and business identifiers, authentication metadata, and access-related information, and researchers have previously linked ExfilSquad intrusions to improperly configured **Microsoft Power Pages** data tables. Public reporting noted that Wesco may use **Microsoft Dynamics 365**, suggesting the incident may involve exposed cloud CRM components rather than malware-driven network compromise.
Aug 12, 2026
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026