A suspected Microsoft Power Pages configuration failure has been linked to the exposure of roughly 27 million records across 13 organizations, after the data-extortion group ExfilSquad published 382.64 GB of alleged victim data via torrent distribution.
Researchers assessing the released material say the evidence points to publicly readable Microsoft Dataverse tables not a zero-day exploit, ransomware deployment, or conventional network intrusion.
In this case, investigators from Fortra’s Intelligence and Research Experts (FIRE) found that the datasets structurally resembled exports from Microsoft Dynamics 365 CRM and ERP environments backed by Dataverse.
Microsoft Power Pages enables organizations to build external-facing web portals connected to Dataverse.
It is designed to support legitimate public workflows such as citizen services, customer support, registrations, or application forms but access depends on table permissions and web-role assignments.
The leading hypothesis is that affected portals assigned the Anonymous Users web role to Dataverse table permissions that granted public read access.
When such a permission is applied to sensitive tables, unauthenticated visitors may be able to retrieve records through the portal’s exposed API layer.
Researchers reported no evidence that ExfilSquad needed malware, lateral movement, credential theft, or an exploited software vulnerability to access the data.
This distinction matters operationally. A vulnerable application requires patching; a misconfigured portal requires immediate access-control correction, data-exposure assessment, and credential or identity-risk response.
The campaign underscores a recurring cloud-security reality: a legitimate SaaS feature configured with overly broad anonymous permissions can become an internet-accessible data-exfiltration channel.
Organizations should not assume that a clean endpoint environment means their data is protected if a public-facing portal exposes backend tables by design.
Fortra’s assessment tied the 382.64 GB archive to 13 organizations and approximately 27 million records.
Reported victims include government and education-sector entities, with publicly discussed datasets involving organizations such as the City of Atlanta, the UK Department for Education, and District of Columbia Public Schools.
Security researchers from XM Cyber have recently discovered a series of vulnerabilities in Microsoft System Center Configuration Management (SCCM) that could be chained together to achieve remote code execution.
Misconfigured Microsoft Power Pages
The potential impact extends beyond generic contact data. Reported samples included personally identifiable information, CRM records, service and support data, and in education-related datasets student names, birth dates, and unique student identifiers.
Such material can fuel spear-phishing, identity fraud, account-recovery attacks, impersonation, and follow-on targeting of employees, students, citizens, customers, and partners
ExfilSquad reportedly emerged in late July and publicly released victim data on August 7, converting extortion claims into a broad downstream privacy and fraud risk.
The group’s activity also illustrates how cloud data exposure can become mass-harvestable: once a portal is public and its API returns records, a threat actor can automate collection without breaking into an internal network.
Security teams operating Power Pages should urgently review every portal with anonymous access and identify whether table permissions grant read rights beyond the minimum required business process.
Particular attention should go to tables containing contacts, accounts, leads, incidents, annotations, opportunities, case records, or custom entities containing personal, financial, employee, or operational data.
Administrators should remove the Anonymous Users role from any table permission that does not explicitly require public data access.
Where anonymous access is necessary, permissions should be scoped narrowly and API-enabled tables should expose only explicitly required fields rather than wildcard field selections.
Microsoft has also restricted anonymous Web API wildcard configurations for certain system tables to reduce unintended broad disclosure.
As a practical validation step, defenders should test their own externally reachable portals from an unauthenticated session and confirm that API routes do not return record bodies.
Any successful response containing Dataverse data should be treated as an active exposure, investigated for historical access, and remediated immediately.
The incident is a reminder that identity and authorization configuration is part of an organization’s attack surface.
For Power Pages deployments, a single overly permissive web-role assignment can turn a customer portal into a bulk data-export interface for anyone on the internet.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
