ExfilSquad: 7 Things Security Teams Need to Know

What does it actually take to breach a police database, a Fortune 500 chipmaker, and a national education department in the same week? On the evidence gathered so far about the group calling itself ExfilSquad, none of the usual things. No exploit was written, no malware was involved, and no password was cracked.

On July 26, 2026, a previously unknown data extortion group calling itself ExfilSquad posted a single leak-site update naming roughly 15 organizations across five countries as victims: private companies, municipalities, school systems, and government bodies, all at once. Four days later, the story has real regulatory weight behind it, the UK’s Information Commissioner’s Office and National Crime Agency are involved, and it has a working technical explanation from an independent research firm. That explanation is the story worth reading, and it looks nothing like the headlines describing it.

1. ExfilSquad appeared out of nowhere, and named 15 victims on day one

Most extortion groups build a track record one victim at a time. ExfilSquad’s debut, as reported by Protos, listed roughly 15 alleged victims simultaneously, including Wesco International, Microsoft, Allstate, the UK’s Police National Legal Database, and the Department for Education. The group’s leak-site message follows the standard extortion script: pay, or the data gets published and stays public forever. Reporting from The Times suggests the motive is financial rather than political, and named victims were given until August 5 to respond.

2. The most credible technical account: nobody exploited anything

This is the finding that matters more than any individual victim name. VenariX’s own analysis states it directly: the firm found no evidence of ransomware deployment, malware use, lateral movement, or exploitation of a software vulnerability. The available evidence instead points to anonymous users being granted overly broad access to Dataverse records through public Microsoft Power Pages portals.

Power Pages is Microsoft’s low-code platform for building external-facing websites on top of Dataverse, its underlying business data platform. Every Power Pages site has an “Anonymous Users” web role, and Microsoft’s own documentation is explicit about what happens when that role gets table access: when the Anonymous users web role is granted access to a table, any user who visits the site can access the data in the table. No password. No exploit. Just a configuration setting left in the wrong position.

3. Two named victims turned theory into confirmation

VenariX didn’t stop at inference. The firm reviewed data samples tied to 11 of ExfilSquad’s 15 claimed victims and found Dataverse-consistent structures in all 11, then found two organizations willing to independently confirm the pattern.

Frontier Airlines confirmed on July 9, 2026 that an unauthorized party accessed a data storage account containing personal information, weeks before ExfilSquad’s public listing and without the airline attributing it to the group by name. And for the City of Houston, tied to the Houston 311 non-emergency service portal, VenariX went further still: it confirmed the public-facing portal returned incident records without requiring authentication, and that those records matched what ExfilSquad had already published. A live, unauthenticated request pulling real records that show up on the leak site, alongside a named victim’s own disclosure lining up with the same timeline, is about as close to a smoking gun as OSINT-level research gets.

VenariX is careful about the limits of that finding. Its own writeup states the evidence does not yet confirm that every organization was affected through an exposed Power Pages portal or the same configuration issue. Eleven consistent samples out of fifteen claims support a real pattern. They stop short of establishing that all 15 share one root cause.

4. The UK took the hardest confirmed hit so far

Two UK public-sector bodies have the clearest, most consequential exposure to date. The Police National Legal Database, used for more than 30 years by all 43 Home Office police forces in England and Wales plus the British Transport Police, confirmed a breach exposing full names, organizations, and email addresses of more than 100,000 officers and criminal justice staff. ExfilSquad claims 135,000 records, roughly 114,000 PNLD subscribers and 21,000 users of PNLD’s public “Ask the Police” tool, totaling about 1.9GB.

The Department for Education was hit alongside it, with around 600,000 to 607,000 records taken from its help-desk portal: names, emails, phone numbers, and job titles belonging to parents, school leaders, university staff, and government officials. Both organizations have referred their incidents to the ICO, and the DfE says it’s working with the National Cyber Security Centre and the National Crime Agency. One detail worth flagging rather than smoothing over: one national newspaper reported that passwords were among the PNLD data taken, an account PNLD has not confirmed. That discrepancy was still unresolved as of this writing, which is itself a useful reminder for point 6.

The practical risk for the people on those lists is immediate, not theoretical. Security Affairs points out that officers and staff whose details were exposed should expect targeted phishing built around the exact combination now sitting on the dark web: a real name, a real organization, and a real work email address. Put those three fields together and you have a ready-made phishing kit, which is exactly why “only contact details were taken” undersells what those details are actually good for.

5. Not every name on the list carries the same weight

This is where ExfilSquad’s story stops being a straightforward breach narrative and starts being a lesson in reading extortion claims critically. When the group posted its 15-victim list on July 26, none of the entries, including Microsoft, came with proof-of-compromise or sample data. Threat intelligence analysts initially assessed the announcement as likely fabricated or inflated, a reasonable read given that mass, unsubstantiated victim claims are a known tactic for generating media coverage and negotiating leverage without doing the work of an actual breach.

That assessment shifted, partially, on July 27, when ExfilSquad released a 4,000-row sample tied to the Microsoft claim. According to CybersecurityTimes, the sample contained Dataverse OData annotations and internally consistent structures across thousands of rows, technical detail that’s difficult to fake convincingly at that volume. That shifts the claim from “almost certainly fabricated” toward “worth continued scrutiny,” a meaningfully different place to sit, short of an actual confirmation.

Analog Devices adds a separate wrinkle worth untangling precisely. The company disclosed two distinct things days apart: a confirmed breach detected in June, and, in its own words, from its SEC filing, a “separately and unrelated” matter it was still assessing, ExfilSquad’s July 26 claim of 570,000 stolen customer records. Analog Devices itself drew the line between those two incidents. Coverage that blends them into one story gets both the timeline and the causation wrong.

6. The fix already exists, and it’s a checkbox someone forgot to tick

There’s no CVE here, which is part of why this story is easy to underestimate. Microsoft’s own Power Platform blog describes a tenant-level governance control, “Disable anonymous access”, that administrators can apply across all sites, specific sites, or all sites except chosen exceptions. It blocks unauthenticated reads of Dataverse data while still allowing public form submissions to keep working, which matters, since plenty of Power Pages sites are legitimately public-facing.

VenariX’s practical recommendation is the same thing phrased as an audit checklist: review Anonymous Users table permissions, review Web API settings, check for legacy OData feeds still exposed, and validate access from a genuinely unauthenticated browser session rather than trusting the admin console’s own summary.

7. What this actually means if your organization runs Power Pages, or anything like it

Strip away the platform-specific detail and ExfilSquad’s pattern generalizes to almost any external-facing portal built on a low-code or SaaS data layer: a setting that was correct at launch, or correct for one table, quietly stops being correct as the site grows, and nobody’s watching for that drift because there’s no patch to apply and no CVE to track. But that pattern is bigger than Power Pages specifically. It’s exactly what Angriffsflächenmanagement exists to catch, exposed or misconfigured internet-facing assets found from the outside, the same vantage point ExfilSquad had. The harm was always the records sitting behind that setting, which is squarely Prävention von Datenschutzverletzungen territory.

It’s also worth sitting with point 5 a moment longer, because it’s the part a security team can act on immediately, independent of anything ExfilSquad specifically did. A leak-site listing is a claim. A validated finding, checked against a real sample, a real unauthenticated request, a real matching record, is something else. That distinction, between an alert and a confirmed incident, is the same discipline that separates a genuinely useful monitoring program from a feed of unverified noise.

FAQs

If your organization runs Power Pages, Dataverse, or any public-facing portal built on a low-code platform, the more useful question is what else looks like this across your entire external footprint, not just the one system this story happened to name. Angriffsflächenmanagement finds that before the next leak-site update does it for you.