ExfilSquad Breach Compromises 27 Million Records via Microsoft Power Pages

In mid-August 2026, cybersecurity intelligence researchers at Fortra (Fortra Intelligence and Research Experts, or FIRE) officially validated widespread data extortion claims stemming from the massive ExfilSquad breach. The incident has resulted in the exposure of approximately 27 million records across 13 public and private sector entities, totaling 382.64 GB of exfiltrated enterprise data. Rather than leveraging advanced zero-day exploits, destructive malware payloads, or complex lateral movement within enterprise networks, the threat group systematically weaponized misconfigured Microsoft Power Pages SaaS web portals to harvest underlying Microsoft Dataverse and Microsoft Dynamics 365 (D365) databases.

The scope of compromised organizations spans municipal governance, critical national infrastructure, federal and regional education boards, and commercial enterprises. The fallout from the ExfilSquad breach serves as a watershed moment for modern enterprise security, exposing the acute operational risks inherent in low-code/no-code application development when access controls and default SaaS permissions fall outside rigorous cybersecurity governance.

Anatomy of the ExfilSquad Breach and Extortion Timeline

The threat collective known as ExfilSquad initially surfaced on July 26, 2026, deploying an onion-hosted data leak site (DLS) listing 15 high-profile victims. Initial skepticism from the cybersecurity community quickly shifted to alarm on July 28 and August 7, when the group released substantive proof-of-concept samples followed by full torrent archives. ExfilSquad followed an unvarnished extortion playbook: having exfiltrated massive swaths of corporate and institutional data without deploying ransomware to disrupt systems, the actors demanded ransom payments under the threat of public release.

When target organizations refused to capitulate to the financial demands by the threat actor’s August 5 deadline, ExfilSquad published comprehensive data dumps under the archive naming convention [victim]_exfilsquad. The dump included structured tables containing personally identifiable information (PII), corporate CRM data, internal tickets, employee directories, and judicial contact information.

Key Organizations Impacted in the Data Leak

Fortra FIRE confirmed that at least 13 organizations suffered verifiable data leaks following ExfilSquad’s campaign. Prominent victims identified in the investigation include:

• City of Atlanta (atlantaga.gov): Sustained an exposure exceeding 36 GB and encompassing more than 3 million individual database records.
• U.K. Department for Education (education.gov.uk): Experienced the exfiltration of more than 600,000 administrative and organizational records.
• U.K. Police National Legal Database (PNLD): Over 100,000 sensitive contact records and credentials belonging to police officers and criminal justice practitioners were compromised.
• District of Columbia Public Schools (DCPS): More than 60,000 student records were published, including student names, birthdates, and unique identifiers. ExfilSquad claimed to have selectively redacted portions while openly lambasting the institution’s data governance posture.
• Commercial Sector Entities: Global insurance provider Allstate, Frontier Airlines, and several industrial and manufacturing corporations also sustained verified data theft from their external-facing instances.

Technical Analysis: Weaponizing Low-Code Architectures and Dataverse APIs

A crucial revelation in the technical post-mortem conducted by Fortra and independent threat intelligence teams is that the perpetrators did not penetrate network perimeters via compromised credentials, phishing campaigns, or software vulnerabilities. Instead, the threat actor relied on basic HTTP request automation targeting the inherent architecture of Microsoft Power Pages.

Microsoft Power Pages—a low-code Software-as-a-Service (SaaS) platform widely adopted to build external-facing corporate portals—relies on Microsoft Dataverse as its underlying relational database engine. Dataverse stores business logic, CRM tables, case histories, and user identities. The platform natively incorporates a built-in RESTful Web API accessible via the standard /_api endpoint path, allowing developers to execute standard CRUD (Create, Read, Update, Delete) operations against backend tables.

GET https://[subdomain].powerappsportals.com/_api/[EntitySetName] HTTP/1.1
Host: [subdomain].powerappsportals.com
Accept: application/json

The core failure stemmed from permission inheritance and web role assignment within the Power Pages administrative interface. When administrators created custom tables or integrated Microsoft Dynamics 365 entities, they frequently assigned read permissions to the default “Anonymous Users” Web Role. In many enterprise deployments, developers inadvertently granted global read access or left Table Permissions unconfigured under the assumption that if an entity was not explicitly linked in the visual portal interface, it remained private.

In reality, the underlying Web API route (/_api) exposes all configured EntitySetNames regardless of whether they appear on the visual user interface. Threat actors deployed automated enumeration scripts that systematically crawled public Microsoft Power Pages portal subdomains, querying default Dataverse entity names (such as contacts, accounts, incidents, and custom administrative schemas). Where the “Anonymous Users” role had read permissions active, the API returned complete JSON arrays containing unencrypted database records directly to the attacker’s scraper.

The SaaS Blind Spot: Why Traditional Defenses Failed

The scale of the ExfilSquad breach illustrates an urgent operational blind spot plaguing modern security operations centers (SOCs). For over a decade, security teams have focused defensive budgets on Endpoint Detection and Response (EDR), perimeter intrusion prevention, micro-segmentation, and zero-trust identity authentication. However, SaaS and low-code applications effectively sit entirely outside traditional perimeter logging mechanisms.

Because the data scraping occurred over legitimate, public-facing HTTPS web API endpoints, standard Web Application Firewalls (WAFs) and IDS/IPS sensors viewed the incoming queries as normal, authorized web traffic. Without dedicated SaaS Security Posture Management (SSPM) tools continuously scanning API permission tables, security teams had zero visibility into the ongoing exfiltration until ExfilSquad posted their claims on dark web forums.

Remediation and Defensive Guidance for Power Pages Environments

In light of the confirmed breaches, organizations utilizing Microsoft Power Pages, Microsoft Power Apps, and Dynamics 365 must audit their environment configurations immediately to prevent unauthorized data exposure. Security administrators should take the following technical actions:

1. Audit Web Roles and Remove Anonymous Access: Inspect the Power Pages Security settings and ensure that the Anonymous Users Web Role is never granted Read, Append, or Write access to Dataverse tables containing PII, operational data, or internal service tickets. Table access should strictly require authenticated web roles.
2. Enforce Table and Column-Level Permissions: Ensure Table Permissions are explicitly enabled for every entity exposed to the web portal. Avoid setting Access Type to “Global” unless absolute public dissemination is required; prefer “Contact” or “Account” access types that isolate record visibility strictly to authenticated users associated with that record.
3. Restrict Web API Endpoint Exposure: Review site settings in the Power Pages Management application. Specifically check Webapi/[table_name]/enabled and disable API exposure for any backend tables that do not require programmatic portal interaction.
4. Implement Strict Column-Level Security: For tables where partial public access is mandatory (e.g., public intake forms), apply Column Permissions to prevent sensitive fields—such as social security numbers, dates of birth, internal notes, or password metadata—from being queried.
5. Integrate Continuous Posture Auditing: Deploy automated SaaS configuration scanning and regularly utilize the built-in Microsoft Power Pages Security Center checker to identify misconfigured access controls prior to production deployment.

Conclusion: The Changing Nature of Enterprise Extortion

The confirmed data leaks orchestrated by ExfilSquad mark a significant shift in threat actor methodology. Rather than investing substantial resources into deploying double-extortion ransomware and battling enterprise EDR agents, threat actors are weaponizing API misconfigurations within cloud-hosted business applications. As low-code development accelerates across government agencies and multinational corporations, security leaders must recognize that default convenience cannot supersede strict data segmentation. Securing cloud APIs and enforcing strict role-based access controls across all SaaS layers must be treated as critical enterprise perimeter defense.