A data extortion crew calling itself ExfilSquad surfaced on 26 July 2026 naming roughly 15 victims in a single leak-site post, and by 7 August had dumped 13 of them via BitTorrent. Fortra Intelligence and Research Experts (FIRE) reviewed the samples and concluded the group's claim to hold sensitive data is correct, with the leading theory on initial access being misconfigured public-facing Microsoft Power Pages portals granting anonymous read access to Dynamics 365 and Dataverse tables. Record counts vary sharply by source: Infosecurity Magazine, citing FIRE, puts the published archive at 382.64 GB and 27 million records across 13 victims, while Power Platform analyst Jukka Niiranen writes of 4.6 million confirmed leaked records. No exploited vulnerability, no malware and no ransomware payload has been found by any researcher in this source set.
What Happened
ExfilSquad appeared with no track record on 26 July 2026, posting roughly 15 alleged victims at once across five countries: municipalities, school systems, universities, financial institutions, manufacturers, transportation firms and national government bodies. CybelAngel notes the debut list, as reported by Protos, included Wesco International, Allstate, Microsoft itself, the UK's Police National Legal Database (PNLD) and the UK Department for Education.
The claims were initially met with skepticism because no evidence accompanied them. SOCRadar, per UNDERCODE NEWS, described many of the claims as unverified and flagged the possibility of reused or fabricated data. An earlier assessment carried by CTI Pilot went further, characterising most of the brand's other claims as looking fabricated at the time.
The group then did what extortion crews do: it proved itself. Fortra records sample releases on 28 July and again on 7 August. Victims were given until 5 August to pay. On 7 August, 13 victim archives named in the [victim]_exfilsquad format were published via torrent, with the group stating those organisations had not met its agreements. Notably, Zenith Bank Plc and Analog Devices, both on the original 15-name list, did not appear in the dump, which FIRE explicitly flagged.
Regulatory machinery is engaged. PNLD, operated by West Yorkshire Police, is working with the National Crime Agency and specialist cyber-security firms, and has notified the Information Commissioner's Office.
What Was Taken
Volume figures depend entirely on who is counting and what they are counting.
- Aggregate torrent archive: 382.64 GB and 27 million records across 13 victims, per FIRE's analysis as reported by Infosecurity Magazine. This appears to be a raw row count of the published dumps.
- Confirmed leaked records: 4.6 million, per Niiranen's write-up. This is a materially different number from the 27 million archive figure and the two are not reconciled in any source available here.
- City of Atlanta: more than 36 GB including 3 million records (Cybersecurity Dive).
- Allstate: more than 15 GB including 657,000 records (Cybersecurity Dive).
- District of Columbia Public Schools: 60,000 records including student names, dates of birth and unique student identifiers. ExfilSquad claimed it released a censored version and destroyed the original, posting that it would not "dox a bunch of school children" but would expose DCPS's handling of data on children as young as six.
- PNLD: an early third-party figure of 135,000 records circulated, but CTI Pilot flags that number as a third-party reporting artefact later corrected against the victim's own statement.
PNLD's own statement, the strongest primary account in this set, confirms that "Information including the names, organisations and work email addresses of police officers, staff and other criminal justice professionals, government partners and customers has been compromised and published on the dark web," that the incident was identified on Sunday 26 July 2026, and that "There is no evidence to suggest that passwords or other security credentials have been compromised." The statement also disclosed a second affected service not previously reported: Ask the Police, the public enquiry site PNLD hosts, from which names and email addresses of citizens who had submitted questions were also published.
PNLD is equally specific about what was not touched: not the Police National Computer, not the Police National Database, not a crime-recording system, and holding no confidential material on victims, witnesses or offenders.
Why It Matters
This is a configuration failure at scale, not an intrusion campaign. FIRE found no evidence of exploited vulnerabilities, network compromise, lateral movement or encryption payloads. What ExfilSquad appears to have done is enumerate internet-facing Power Pages sites and read tables that were left anonymously readable, then package the results.
Three consequences follow for defenders.
First, the blast radius of one checkbox in a low-code platform is now demonstrably a national police service and a municipal government in the same week. Power Pages sits directly on top of Dataverse, so a permissions mistake at the portal layer exposes the CRM record store behind it rather than a static web asset.
Second, the attacker skill floor is at the ground. The ExfilSquad figure interviewed by The Times described getting to this data as "stupid easy," and Niiranen notes the group ran a broad sweep specifically hunting insecure Power Pages data tables. Anyone can run that sweep.
Third, the extortion economics did not work and the data got published anyway. Thirteen of fifteen named organisations were dumped after the 5 August deadline. Organisations weighing a payment decision should note that this crew released regardless, and released via torrent, which makes takedown effectively impossible.
Accounts differ on motive. Niiranen's read of The Times interview is that the group is mostly teenagers hacking government "for fun," driven by recognition and identity rather than primarily money. CybelAngel's summary of the same Times reporting says the motive is financial rather than political. Both readings can be partly true of a loosely organised crew, but they are not the same threat model and should not be collapsed into one.
The Attack Technique
The technical explanation converges across every research source here. Fortra states the breach is "most likely limited to unauthorized access of Microsoft D365 CRM and ERP instances," with the leading initial-access theory being "misconfigured Microsoft Power Page portals that allowed for public read access." Cybersecurity Dive, UNDERCODE NEWS and CTI Pilot all report the same anonymously-readable-portal path. An earlier July report from security firm Veranix, referenced by Cybersecurity Dive, carried the initial claims.
One caveat matters and is easy to lose. CTI Pilot is explicit that researchers traced the ExfilSquad campaign to anonymously readable Power Pages portals, but not PNLD's own root cause. PNLD's published statement does not attribute its incident to a Power Pages misconfiguration. Treat the platform-level explanation as well supported for the campaign and unconfirmed for any individual victim unless that victim has said so.
On the vendor response: Niiranen reports that Microsoft is shipping a hotfix that bans one of Power Pages' most dangerous Web API configurations, effectively removing the ability to configure the setting that enabled anonymous table reads. That account rests on a single source in this set, with no corresponding Microsoft security advisory available here. Administrators should verify the specific change against Microsoft's own release notes before assuming their tenant behaviour will or will not shift.
What Organizations Should Do
- Inventory every internet-facing Power Pages site in every tenant, including ones nobody owns. The campaign was a broad sweep. Sites built by a departmental citizen developer three years ago and never decommissioned are exactly the target profile.
- Audit table permissions and Web API settings for anonymous read. For each site, enumerate which Dataverse tables are exposed through the Web API and which web roles can read them, with specific attention to any grant reaching the anonymous role. Assume the setting is wrong until you have read it yourself.
- Pull portal access logs back to at least mid-July 2026. Look for high-volume sequential Web API reads from single sources, which is what enumeration of this kind looks like on the wire. FIRE found no lateral movement, so endpoint and network telemetry will show nothing useful here; the evidence lives in the portal request logs.
- Assume contact-graph exposure, not credential exposure, and plan comms accordingly. The confirmed PNLD data is names, employers and work email addresses. That is phishing and social-engineering fuel aimed at police, criminal justice professionals and government partners. Warn affected staff about targeted approaches referencing real colleagues and real case context.
- Verify the Microsoft hotfix against your own tenant. If the reported configuration ban ships, some existing sites may break where they relied on anonymous read. Identify those dependencies now rather than discovering them during a forced change window.
- Treat torrent redistribution as permanent when scoping notification. The 7 August archives are peer-to-peer. Regulatory notification and individual notification decisions should be made on the basis that the data stays available indefinitely, not that it can be contained.
Sources: Stupid easy: the Power Pages data leak story and aftermath | Researchers Confirm ExfilSquad’s Access to Sensitive Data - Infosec... | PNLD Confirms Data Breach Affecting UK Police and Justice Staff | Researchers confirm breach claims by data-extortion group | ExfilSquad’s Data Extortion Campaign Exposes a Dangerous Microsoft... | PNLD confirms the police contact-data breach and names a second aff... | ExfilSquad: New Data Extortion Group Leaks Microsoft ... | ExfilSquad: 7 Things Security Teams Need to Know