27M records exposed: hackers target Microsoft Power Pages in massive data heist

Organizations running Microsoft’s Power Pages tied to Dynamics 365 have been caught in a massive data exfiltration campaign.

A new data extortion group appears to have found a remarkably simple route into the databases of governments, universities, airlines, and major companies. And it is publicly exposed Microsoft portals that may have allowed anyone to read sensitive private and business records.

The emerging group ExfilSquad claims to have stolen more than 27 million records from 13 organizations and released hundreds of gigabytes of data after its victims allegedly failed to meet an August 5th deadline.

An investigation by Fortra Intelligence and Research Experts (FIRE) suggests this is not a conventional ransomware attack, as there is currently no evidence of a Microsoft Dynamics 365 vulnerability being exploited.

Instead, the evidence points toward misconfigured Microsoft Power Pages sites that may have exposed data stored in Microsoft Dataverse to anonymous visitors.

Not a regular ransomware attack

ExfilSquad, the extortion crew behind the attack, first appeared on July 26th, 2026, publishing a leak site on the dark net and claiming to have compromised 15 organizations.

The initial claims were not as serious, as the group offered little evidence. Two days later, however, ExfilSquad began publishing data samples intended to prove that its claims were real.

Fortra researchers obtained and analyzed those samples. Its researchers concluded that the data may have originated from a breach, although they found no evidence for a broad network compromise normally associated with ransomware operations.

“We were able to access the data samples for analysis. Our analysis suggests that this is a valid data breach, although it is unlikely to represent a full organizational-level compromise, as the data appears to be limited to SaaS,” Fortra researchers said.

The stolen information appears to come primarily from Microsoft Dynamics 365 CRM and ERP environments, with data formats strongly resembling exports from Microsoft’s Dataverse platform.

The investigation found no evidence of encryption payloads, lateral movement through corporate networks, or a software vulnerability in Dynamics 365 itself.

Public-facing Power Pages enable data exfiltration

The researchers’ leading theory is that ExfilSquad found publicly accessible Microsoft Power Pages sites connected to Dataverse.

Power Pages is Microsoft's platform for building external websites and portals. Organizations can use it to allow customers, employees, partners, or members of the public to interact with business data.

That functionality comes with an obvious security problem. Some data needs to be available to anonymous visitors, while other data absolutely should not be.

Microsoft's documentation warns that assigning certain table permissions to anonymous users can allow anyone visiting the site to read the data.

However, if the configurations are not intact, anonymous users may have access to way bigger internal datasets.

“We were able to identify over 10,000 potential Power Pages instances accessible to the public,” the researchers said.

Victims span governments, schools, and major companies

By August 7th, ExfilSquad had published torrent files for data allegedly belonging to 13 organizations.

The victims span an unusually broad range of sectors, including government, education, financial services, manufacturing, technology, aviation, and law enforcement.

Among those named by the group are:

• Allstate
• The City of Atlanta
• Bonava
• District of Columbia Public Schools
• The UK’s Department for Education
• Frontier Airlines
• The City of Houston
• Newcastle University
• The UK Police National Legal Database
• TaylorMade and Sun Day Red
• Viavi Solutions
• Wesco International

Two companies, Zenith Bank Plc and Analog Devices, were removed from the list. It remains unclear why those organizations disappeared or whether they reached an agreement with the attackers.

The alleged City of Houston dataset alone contains around 6 million records, according to ExfilSquad’s description, while the Atlanta data allegedly contains roughly 3 million records.

Frontier Airlines is listed with approximately 2.4 million records, while TaylorMade and Sun Day Red are listed with around 2 million.

The datasets described by ExfilSquad include:

• Names
• Addresses
• Contact information
• Customer service records
• Employee information
• Recruitment data
• Student information
• Case histories
• Business records
• Other personal or corporate data

The alleged DC Public Schools dataset is particularly sensitive. ExfilSquad said it censored the release.

“We are not going to doxx a bunch of school children, but we are going to expose how incompetent DCPS is at keeping children as young as 6’s information safe,” the gang said.

How to stay safe?

Organizations using Power Pages should first check whether their portals allow anonymous users to access Dataverse data. Security teams can use the Power Pwn Power Pages module to test a specific portal for anonymous access to Dataverse tables.

If exposure is found, the key step is to disable anonymous access to business data and preserve logs and portal settings.

Organizations should identify which portals and records were exposed, including any sensitive customer or employee information, and rotate credentials or API keys found in exposed records where necessary.

In the following days, security teams should audit every Power Pages portal, document its owner and connected Dataverse environment, and enforce a zero-trust approach.

Users should be authenticated before accessing business data, and organizations should test their portals from the perspective of an unauthenticated visitor to make sure sensitive records cannot be viewed or downloaded.

Organizations should also review connected services such as Power Automate, SharePoint, Power BI, payment systems, custom connectors, and service accounts.