Summary
- Fortra says ExfilSquad published around 382GB of data containing approximately 27 million records from 13 organisations.
- Researchers found evidence consistent with publicly readable Dataverse tables exposed through Power Pages permissions.
- The analysis found no exploited vulnerability, malware, lateral movement or encryption component.
A data-extortion campaign involving an alleged 27 million records has been linked to overly permissive Microsoft Power Pages and Dataverse configurations, with researchers finding no evidence that attackers exploited a new platform vulnerability.
Fortra’s FIRE research team says the ExfilSquad group published roughly 382GB of information associated with 13 organisations. Analysis of the released samples found structures consistent with Microsoft Dataverse exports and pointed towards public Power Pages permissions as the likely route to the information.
The researchers found no malware, lateral movement, encryption payload or exploited software vulnerability in the material they examined. Their leading explanation is that the Anonymous Users web role had been granted permission to read Dataverse tables exposed through a Power Pages portal.
That conclusion remains a research assessment rather than a complete forensic account from every affected organisation. The record total is also derived from the extortion group’s publication and Fortra’s subsequent analysis, rather than an independently consolidated disclosure from all 13 organisations.
Power Pages allows organisations to create externally accessible websites connected to data held in Microsoft Dataverse. Public access is an intentional feature, but administrators can define which tables and records anonymous visitors are permitted to read.
If those permissions are broader than intended, a portal can expose sensitive business information through legitimate application functionality. An attacker does not necessarily need to bypass authentication or exploit a software flaw if the platform has already been configured to return the data to an unauthenticated user.
Fortra said it identified more than 10,000 publicly accessible Power Pages instances while investigating. That figure does not mean 10,000 portals are leaking data. Public availability is expected for many deployments, and exposure depends on the table permissions configured behind each service.
The distinction changes the remediation problem. A conventional zero-day would place immediate attention on a Microsoft patch and vulnerable software versions. A permissions failure instead puts asset ownership, deployment review and access governance at the centre of the response.
Low-code platforms make those responsibilities harder to map because application development can move outside central software teams. One group may manage the Microsoft tenant, another own the underlying records and a business team configure the external portal. A valid setting can therefore create a security failure without any component behaving contrary to its design.
That also limits the usefulness of conventional vulnerability management. There may be no CVE to scan for, malicious executable to detect or patch to deploy. Organisations instead need visibility over public endpoints, anonymous roles and the relationship between application permissions and the data stored behind them.
The Power Platform provides mechanisms to restrict that access, but governance becomes more difficult as the number of applications grows. Data-protection and security obligations remain with the organisation controlling the records regardless of whether exposure originates in custom software or a low-code configuration.
Fortra’s evidence currently supports a configuration-led explanation more strongly than claims of a Microsoft platform breach. If subsequent victim investigations confirm the same route, the ExfilSquad disclosures will provide a significant example of how ordinary low-code permissions can become a bulk-exfiltration path when public access is not reviewed carefully.
