At a glance:
- A recently disclosed data extortion campaign led to the publication of millions of records from multiple organizations, most likely obtained through misconfigured Microsoft Power Pages deployments.
- The activity appears to have relied on anonymous access permissions that exposed Microsoft Dataverse data through internet-facing portals, allowing attackers to enumerate and export records without exploiting a software vulnerability.
- Organizations using Power Pages are advised to review anonymous access permissions, Dataverse table access, exposed application programming interface (API) endpoints, and public-facing portal configurations to identify and reduce unintended data exposure.
Threat summary
On August 13, 2026, Fortra published research on ExfilSquad, a data extortion group that emerged in late July claiming to have stolen data from multiple organizations.
Analysis of the released samples supported the group's claims and found the exposed data was consistent with exports from Microsoft Dynamics 365 (D365) customer relationship management (CRM) and enterprise resource planning (ERP) environments. Researchers assessed that the data was most likely obtained through misconfigured Microsoft Power Pages deployments that exposed Microsoft Dataverse data to anonymous users.
Approximately 27 million records across 13 organizations were ultimately published by ExfilSquad. The exposed data reportedly included customer records, employee information, support tickets, account data, admissions records, municipal service requests, and other operational information maintained within D365 environments.
Power Pages is Microsoft's platform for building internet-facing portals connected to Microsoft Dataverse, the data platform that underpins D365 applications. Organizations use these portals for customer services, citizen services, recruiting platforms, case management systems, supplier portals, and other self-service applications that provide external users with access to business information and processes.
According to Microsoft documentation, assigning the Anonymous Users web role to a Dataverse table permission can allow records to be read without authentication. When these permissions are applied to business data, information may become accessible through internet-facing Power Pages application programming interface (API) endpoints and OData feeds. The structure of the leaked datasets was consistent with Dataverse exports, supporting the assessment that the records were obtained directly through exposed portal functionality.
After identifying an exposed Power Pages deployment, an adversary can determine whether anonymous access is enabled, query accessible APIs, enumerate available tables and records, and export data directly from the connected Dataverse environment. The exposure stems from permissions that allow unauthenticated users to access data the portal is authorized to retrieve.
Researchers also identified publicly available tools capable of discovering Power Pages deployments and testing for anonymous access, enabling threat actors to identify exposed environments at scale and focus on portals containing customer information, employee records, support cases, financial data, municipal records, and other business information.
Researchers reported identifying more than 10,000 publicly accessible Power Pages instances during their investigation. While an exposed portal does not necessarily indicate a breach, anonymous access to Dataverse data can create a direct path to business information without requiring stolen credentials or access to the organization's internal network.
Analysis
ExfilSquad activity focused on identifying Power Pages deployments that exposed Dataverse data through anonymous access permissions, allowing them to collect information directly from business applications rather than compromising endpoints or internal networks.
For operational teams, the first step is understanding where Power Pages is being used and what data each portal can access. Review all internet-facing Power Pages sites and identify which Dataverse tables are exposed through them. Pay particular attention to Anonymous Users roles, table permissions, custom business tables, and any API or OData endpoints that can be reached from the internet.
Regular permission reviews can help uncover data that is accessible to a broader audience than intended. Customer portals, citizen services, recruiting platforms, and other externally facing applications often contain customer records, employee information, support cases, and other sensitive business data, making them a good place to start.
Monitor Dataverse audit logs, portal activity, API requests, and large-scale data exports for unusual behavior. Looking for unexpected spikes in record access or retrieval activity can help identify potential data collection before it becomes a larger issue.
Power Pages and Dataverse permission reviews are also worth incorporating into deployment, change management, and application update processes. Small configuration changes can significantly alter what data is exposed through a portal, making periodic reviews an effective way to reduce the risk of unintentionally exposing business information.
