ExfilSquad Extorts UK Institutions With Stolen Cloud and CRM Data

ExfilSquad, an emerging data-extortion operation, reportedly breached exposed cloud, CRM, case-management and Microsoft Power Pages data sources belonging to UK public-sector, education and law-enforcement organizations, as well as companies worldwide. Reported victims include the UK Department for Education, the Police National Legal Database and Newcastle University; the alleged thefts exposed hundreds of thousands of contact and personal-data records.

Rather than deploying ransomware to encrypt systems, the group threatens to publish stolen data through a Tor-based leak site. It distributes victim-specific, multi-gigabyte leaks through torrents using separate trackers and web seeds, making takedown and containment more difficult and increasing downstream risks of phishing, social engineering and threats to affected individuals' physical security.