The ExfilSquad data extortion group has been confirmed by researchers to possess sensitive data from at least 13 organizations, spanning government, education, financial services, and manufacturing sectors. The group, which first appeared on July 26, initially claimed to have exfiltrated data from 15 entities. On August 7, data dumps for 13 of these victims were published via torrents, totaling 382.64 GB and 27 million records.
Fortra Intelligence and Research Experts (FIRE) reviewed the publicly released data samples and concluded that ExfilSquad's claims of data access are accurate. Among the confirmed victims are the City of Atlanta (atlantaga.gov), the UK Department for Education (education.gov.uk), and the UK Police National Legal Database.
District of Columbia Public Schools (DCPS) was also listed by the attackers, who stated they would release a censored version of the leak, claiming to have shredded the original from their servers. In this instance, 60,000 records containing student names, dates of birth, and unique student identifiers, among other personally identifiable information (PII), were leaked. Notably, Zenith Bank Plc and Analog Devices, which were part of the initial 15-victim list, were not included in the published data dumps.
The researchers theorize that the data breaches are primarily linked to unauthorized access of Microsoft D365 CRM and ERP instances. The leading hypothesis for the initial attack vector is misconfigured Microsoft Power Pages portals, which allowed for public read access. Power Pages is a Software-as-a-Service (SaaS) platform designed for creating and administering external-facing business websites.
The format of the leaked data was consistent with Microsoft Dataverse exports, suggesting that unauthorized read access was likely achieved during the incidents. Attackers likely identified victims by crawling for misconfigured Microsoft Power Portals or through other enumeration techniques. Given that the breach affected a relatively small number of victims (15, not tens of thousands), it is considered unlikely that a D365 vulnerability was the root cause.
Microsoft Power Pages has a known issue where assigning the "Anonymous Users" web role to a table permission can allow anyone visiting the site to read the table's data. This access can occur via an API, specifically at `https://portal/_api/*`. Microsoft's documentation advises against using this role on publicly exposed sites.
Automated scanning for exposed Power Pages sites is a recognized technique. Fortra's research indicated that it was possible to identify over 10,000 potential Power Pages instances accessible to the public, highlighting the widespread nature of this potential misconfiguration.
