Loading story…
ExfilSquad, an emerging data-extortion operation, reportedly breached exposed cloud, CRM, case-management and Microsoft Power Pages data sources belonging to UK public-sector, education and law-enforcement organizations, as well as companies worldwide. Reported victims include the UK Department for Education, the Police National Legal Database and Newcastle University; the alleged thefts exposed hundreds of thousands of contact and personal-data records.
Rather than deploying ransomware to encrypt systems, the group threatens to publish stolen data through a Tor-based leak site. It distributes victim-specific, multi-gigabyte leaks through torrents using separate trackers and web seeds, making takedown and containment more difficult and increasing downstream risks of phishing, social engineering and threats to affected individuals' physical security.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
On July 26, 2026, ExfilSquad publicly emerged with a Tor-hosted leak site and published 15 alleged victim listings in a single day, including Microsoft, Newcastle University, the Police National Legal Database, and the UK Department for Education. The claims were not accompanied by forensic evidence, verifiable data samples, or independent confirmation; on July 27, the group posted an unverified purported Microsoft directory-record screenshot on X.
ExfilSquad reportedly uploaded multi-gigabyte victim-specific torrent files to its Tor-based leak site to substantiate extortion claims. Resecurity reported that the group assigned each victim a distinct torrent tracker and initial web seed, aiding peer-to-peer distribution of leaked data.
Newcastle University confirmed a potential unauthorized data-access incident linked to ExfilSquad. The incident reportedly exposed about 440,000 applicant and student records, with a configuration flaw in an admissions-system connection cited as the cause.
The Police National Legal Database confirmed a breach linked to ExfilSquad involving reportedly 1.9 GB of data and roughly 135,000 records. The data allegedly included contact details for more than 100,000 police, staff, and criminal-justice professionals and about 21,000 Ask the Police inquiry records.
The UK Department for Education confirmed a breach linked to ExfilSquad. The reported exposure included about 600,000 Help Portal records and about 7,000 Turing Portal records containing parent and staff contact and job information.
In mid-2026, the emerging ExfilSquad group reportedly targeted UK public-sector, education, and law-enforcement organizations, as well as other organizations worldwide. The group allegedly exploited exposed cloud portals, CRM, case-management, and Microsoft Power Pages data sources and threatened to publish stolen data rather than deploying file-encrypting malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcemalware.news
Open sourceblog.bushidotoken.net
Open sourcepnld.co.uk
Open sourcesocradar.io
Open sourceransomware.live
Open sourcesans.org
Open sourcethetimes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026
The UK Department for Education and the Police National Legal Database were hit by a cyber-extortion incident claimed by the previously unknown group **ExfilSquad**, which alleged it stole more than **740,000 records** and posted samples on a leak site. The Department for Education confirmed attackers accessed about **607,000 records** through its Help Desk Self-Service Portal and Turing Scheme Portal, exposing names, job titles, phone numbers, and contact details linked to head teachers, university staff, and government officials. PNLD said roughly **135,000 records** were affected, including details relating to police and criminal justice personnel and some public inquiry data, while stating no confidential victim, witness, or offender information was held in the compromised database.
Aug 6, 2026
**ExfilSquad**, a newly identified data extortion group, has leaked **382.64 GB** of uncompressed data containing roughly **27 million records** from **13 organizations** after claiming a total of 15 victims. The group surfaced on the dark web in late July and initially posted victim names without proof before releasing sample datasets and later full archives. Reported victims include **Microsoft**, **Allstate**, **Frontier Airlines**, the **City of Houston**, the **City of Atlanta**, and multiple education and public-sector entities. Threat intelligence from Fortra indicates the activity was most likely enabled by **misconfigured Microsoft Power Pages** portals that exposed **Microsoft Dataverse** data through the `/_api/` interface, rather than a flaw in Dynamics 365 itself. Researchers identified more than **10,000** potentially exposed Power Pages instances, and said the **Power Pwn** tool was likely used to automate discovery. The group reportedly used infrastructure including IP address `209.99.188.199`, the anonymous file-sharing domain `u.pone.rs`, and a consistent archive naming pattern of `[victim]_exfilsquad.7z` for leaked data.
Aug 18, 2026