Most data breaches start with something loud: a phishing email, a zero-day exploit, a password spray at 3 a.m. ExfilSquad didn't bother with any of that. As far as researchers can tell, they just walked in. The front door was already open.
Let me rewind. On July 26, a previously unknown extortion group appeared out of nowhere and claimed to have stolen sensitive data from fifteen organizations — city governments, universities, a major public school system, private companies. The usual reaction to claims like this is skepticism. Extortion groups bluff all the time. Some of them would happily sell you a screenshot of someone else's breach.
But two independent research teams — VenariX first, then Fortra's intelligence unit — dug into the samples and came to the same uncomfortable conclusion: the data is real.
What we know so far
By August 7, the group had published dumps for thirteen of its claimed victims over torrents. The total haul: 382.64 gigabytes and roughly 27 million records. Among the confirmed casualties is the UK's Police National Legal Database, which saw around 135,000 law enforcement contact records — names, work emails, employers, police force areas — drawn from roughly 114,000 subscribers, most of them serving officers. The same dump also touched staff at the Crown Prosecution Service, the Home Office, the National Crime Agency, and the Ministry of Defence.
That's a lot of very sensitive metadata sitting in the hands of a group nobody had heard of a month ago.
The part that should scare you
Here's what makes this case genuinely different: Fortra found no evidence of an exploited vulnerability, no network compromise, no lateral movement, no encryption payloads, no ransomware. The data formats point to Microsoft Dataverse exports. The leading theory — and both research teams landed on it independently — is that the whole operation came down to misconfigured Microsoft Power Pages portals.
Power Pages is Microsoft's platform for building public-facing websites, and it sits on top of Dataverse, the same data platform that powers Dynamics 365 CRM and ERP. If you've ever set up one of these portals, you know the drill: you assign table permissions, and web roles decide who can read what. The trouble starts when the "Anonymous Users" web role gets a broad table permission. Then anyone who visits the site — no login, no credentials, no nothing — can read the tables through the portal's API, typically at https://<your-portal>/_api/*.
Microsoft documents this risk and explicitly advises against using the Anonymous Users role on publicly exposed sites. The guidance has been there for years. It doesn't help that the default experience makes it easy to get wrong.
So what did ExfilSquad actually do? They appear to have crawled the internet looking for exposed portals — a bit like walking down a street checking which houses left the keys in the door. Then they exported the data and demanded payment. No malware, no exploits, no sophistication. Just enumeration, and bad luck on the victims' side. VenariX confirmed that one of the portals returned incident records without authentication, and the exposed records matched what ExfilSquad later published.
Microsoft is on the victim list too — allegedly
One of the fifteen claimed victims is Microsoft itself. Whether the group actually got anything from Microsoft is unconfirmed, and researchers note there's no proof yet. But security folks like Kevin Beaumont say the portal listings are real, and The Guardian has reported UK organizations like the Department for Education and the police confirming the incidents. The National Crime Agency and the Information Commissioner's Office are investigating.
If you're running Power Pages, treat this as a "check your own house" moment, not a "watch the news" moment.
The checklist
If you run Power Pages or legacy Power Apps portals, here's what VenariX and Fortra recommend — and it's an afternoon of work, not a project:
In the Power Platform admin center, review Power Pages sites → Governance Controls, and consider disabling anonymous access entirely.
In Power Pages Design Studio, go to Security → Table permissions and look for any permission granted to the Anonymous Users web role.
Review Web API settings and disable legacy OData feeds if you don't use them.
Test everything from an unauthenticated browser session — log out, open a private window, and try to fetch data through /_api/. If you can read table data without logging in, so can everyone else.
Fortra even shared a command that tests anonymous access to Dataverse tables via Power Pages, so you don't have to guess.
Why this is a bigger deal than one group
ExfilSquad isn't the first to figure this out, and they won't be the last. Remember 2021, when researchers found that misconfigured Power Apps had left more than a thousand web apps accessible to anyone who stumbled across them? Same class of problem, and it keeps resurfacing because the tools make it so easy to expose data by accident.
The bigger lesson is uncomfortable: the most dangerous vulnerability in your stack may not be a CVE at all. It may be a checkbox. Attackers don't need zero-days when misconfiguration hands them the data on a plate. Ransomware made headlines for years by locking systems; the next wave of extortion may not even need to lock anything. Just take the data quietly and ask for money.
Twenty-seven million records. No malware. No exploit. An open door.
Check yours before someone else does.
Sources
Cybersecurity Dive — "Researchers confirm breach claims by data-extortion group" — https://www.cybersecuritydive.com/news/researchers-confirm-breach-claims-data-extortion/827926/
Fortra (FIRE) — "ExfilSquad: New Data Extortion Group Leaks Microsoft D365 Data" — https://www.fortra.com/blog/exfilsquad-data-extortion-group-ransoming-microsoft-d365-data
Infosecurity Magazine — "Researchers Confirm ExfilSquad's Access to Sensitive Data" — https://www.infosecurity-magazine.com/news/exfilsquads-13-organizations/
Security Affairs — "PNLD Confirms Data Breach Affecting UK Police and Justice Staff" — https://securityaffairs.com/196525/data-breach/pnld-confirms-data-breach-affecting-uk-police-and-justice-staff.html
SC World — "ExfilSquad data extortion group linked to 13 victim data leaks" — https://www.scworld.com/brief/exfilsquad-data-extortion-group-linked-to-13-victim-data-leaks
