A new data-extortion group known as ExfilSquad is claiming responsibility for a large campaign involving data allegedly pulled from misconfigured public-facing Microsoft Power Pages portals connected to Microsoft Dataverse and Dynamics 365 environments.
The campaign is unusual because researchers have not found evidence of a classic ransomware intrusion, malware deployment, lateral movement, or exploitation of a Microsoft Dynamics 365 vulnerability. Instead, the strongest public analysis points to a simpler but dangerous cause: exposed SaaS data caused by misconfigured Power Pages permissions.
What Happened
ExfilSquad appeared publicly on July 26, 2026, claiming to have stolen data from 15 organizations. Initial claims were treated with skepticism, but Fortra’s FIRE team later reviewed samples and said the data appeared valid, with formats strongly consistent with Microsoft Dynamics 365 CRM and ERP / Dataverse exports.
By August 7, ExfilSquad had reportedly published torrent-linked archives for 13 organizations, totaling about 382.64 GB and around 27 million records. Fortra noted that the leaked data appeared to be limited to SaaS environments rather than full corporate network compromise.
The listed victims span several sectors, including aviation, insurance, government, education, manufacturing, technology, law enforcement, real estate, and consumer brands.
The Claimed Victims and Data Volumes
Among the most notable claimed datasets are:
- Frontier Airlines — approximately 2.4 million records, reportedly containing PII, customer support cases, flight and travel information, complaint records, baggage details, and support email communications.
- Allstate — approximately 657,000 records, reportedly containing PII, recruitment and licensing information, onboarding data, and internal employee account information.
- Microsoft — approximately 8 million records, reportedly containing employee and customer contact information, portal identities, corporate account information, business leads, service tickets, access permissions, and other sensitive data.
These figures come from ExfilSquad’s leak descriptions and third-party analysis. Fortra’s sample review supports that the campaign involves real exposed data, but individual victim impact and exact record counts should still be treated carefully until confirmed directly by each organization.
That distinction matters. Extortion groups often inflate or manipulate claims to increase pressure, and Fortra explicitly warned that ransomware and extortion actors frequently exaggerate.
How Power Pages Fits Into the Attack
Microsoft Power Pages is a low-code platform used to build external-facing business websites and portals. These portals can connect to Dataverse, where organizations store business records used by Dynamics 365, Power Platform applications, customer support systems, HR workflows, service portals, and case-management tools.
Power Pages can be used safely, but the security model depends heavily on correct permissions. Microsoft’s own documentation states that access to Dataverse records is restricted by table permissions, and that table permissions must be associated with web roles.
The dangerous case is anonymous access. Microsoft warns that if the Anonymous users web role is added to a table permission, the data in that table is visible to anyone visiting the site.
That appears to be the central weakness behind the ExfilSquad campaign: public portals that unintentionally allowed unauthenticated users to read large amounts of Dataverse data.
No Zero-Day Required
The most important lesson is that this does not appear to be a Microsoft zero-day.
Fortra said it found no evidence of a D365 software vulnerability, no evidence of classic network compromise, and no ransomware-style encryption activity. The observed data formats instead point toward unauthorized read access through exposed Power Pages / Dataverse configurations.
This makes the incident more frustrating, not less.
No exploit chain was needed if sensitive records were already readable through a public portal endpoint.
In other words, the attackers may not have broken through the door. They may have found a door that was mistakenly left open.
Why This Is So Dangerous
The exposed information is not limited to generic contact lists.
The claimed datasets include customer support history, employee onboarding data, licensing data, service requests, flight and travel details, student and parent contact records, law-enforcement contacts, internal case-management records, CRM metadata, business account data, and support communications.
That kind of data can fuel:
- targeted phishing
- identity theft
- customer impersonation
- help-desk social engineering
- business email compromise
- fraud using support case details
- scams referencing real travel, insurance, education, or municipal service records
- extortion using internal business or customer information
- follow-on attacks against employees or customers
CRM and case-management systems are especially valuable because they often contain context. Attackers do not only get names and emails. They may get complaints, support history, relationships, ticket notes, internal routing data, and business process details.
That context makes scams more believable.
Microsoft Was Also Named
One of the most attention-grabbing claims is the alleged Microsoft dataset.
Fortra’s summary lists a Microsoft archive with around 130 GB of uncompressed data and about 8 million records, described by ExfilSquad as containing employee and customer contact information, portal identities, corporate account information, service tickets, and access-related data.
However, independent confirmation remains important. Power Platform community analysts have noted that the alleged Microsoft data may have come from a partner-style portal or Dynamics/Power Platform-related system, but public confirmation from Microsoft was still being awaited in some reporting.
So the careful conclusion is this: Microsoft was named by ExfilSquad, and third-party researchers have analyzed data consistent with the campaign, but the precise Microsoft impact should not be treated as fully established until Microsoft or another authoritative source confirms it.
This Has Happened Before
Power Platform data exposure is not a new risk.
In 2021, researchers reported that misconfigured Microsoft Power Apps portals exposed tens of millions of records across more than a thousand web apps, including contact-tracing data, vaccination sign-up information, job application data, and employee databases.
In 2024, AppOmni research again found significant exposure through misconfigured Power Pages access controls. The research described how excessive privileges granted to anonymous users could expose sensitive records through Power Pages APIs.
That history is important because it shows the issue is not only a one-time campaign. It is a recurring governance problem in low-code and SaaS platforms: business teams can build powerful public-facing portals quickly, but if permissions are wrong, private data can become public.
Why Low-Code Platforms Increase the Risk
Low-code platforms reduce development friction. That is their value.
But they also move security decisions closer to business users, citizen developers, portal makers, and administrators who may not fully understand identity, authorization, table permissions, anonymous roles, or API exposure.
A portal can look correct in the browser while exposing far more through an API.
A public form can be intended only to accept submissions while accidentally allowing reads.
A table permission can be added for convenience during testing and later forgotten.
A copied portal template can inherit unsafe permissions.
That is why Power Pages governance must be treated as SaaS security, not just website administration.
What Organizations Should Do Immediately
Any organization using Microsoft Power Pages, Dynamics 365 portals, Power Apps portals, or Dataverse-backed public websites should review exposure now.
Immediate actions:
- Inventory all Power Pages portals.
Identify every public-facing portal, owner, connected Dataverse environment, business purpose, and authentication method. - Review anonymous table permissions.
Confirm that anonymous users cannot read business data unless that access is explicitly intended and safe. - Disable anonymous Dataverse access where possible.
Microsoft provides governance controls to disable anonymous access to Dataverse data in Power Pages websites. - Test as an unauthenticated user.
Do not only inspect configuration screens. Verify what a public visitor can actually retrieve. - Review the Web API surface.
Microsoft’s Power Pages Web API can perform operations on Dataverse tables when enabled and permitted, so security teams should validate that API access aligns with business intent. - Preserve logs and settings.
If exposure is found, treat it as a security incident. Preserve portal configuration, permissions, logs, audit records, and evidence before making broad changes. - Identify exposed records and affected people.
Determine what data categories were accessible, how long they were exposed, and whether notification obligations apply. - Rotate exposed secrets.
If CRM records contained API keys, access codes, credentials, financial instructions, or integration secrets, rotate them immediately.
What Security Teams Should Monitor
Power Pages and Dataverse access should be part of continuous SaaS security monitoring.
Teams should look for:
- anonymous reads of Dataverse tables
- abnormal Web API access patterns
- large-volume record enumeration
- suspicious query patterns
- unexpected portal configuration changes
- newly created table permissions
- anonymous roles attached to sensitive tables
- exposed attachments or notes
- public access to support, HR, education, insurance, travel, or government case data
- external scanning of Power Pages endpoints
Fortra also recommended treating suspected exposure as a security incident, involving cybersecurity, legal, privacy, communications, insurance, and business leadership teams early.
Final Thoughts
The ExfilSquad campaign is a warning about modern SaaS data exposure.
This does not look like a traditional ransomware event. There is no public evidence of encryption, lateral movement, or a Dynamics 365 zero-day. The stronger evidence points to exposed Dataverse records behind misconfigured Microsoft Power Pages portals.
A misconfiguration in a public-facing business portal can become a mass-extortion incident.
Power Pages, Dataverse, Dynamics 365, and similar SaaS platforms often hold customer, employee, student, citizen, and partner data at massive scale. If anonymous users can read the wrong tables, attackers can harvest the data without breaching the network.
Organizations should review every public portal, disable unnecessary anonymous access, validate table permissions, monitor API access, and treat low-code governance as part of the core security perimeter.
Because in this campaign, the most dangerous vulnerability may have been a checkbox.
