Wesco acknowledges a cloud CRM incident
The American distribution and supply chain giant Wesco has confirmed to BleepingComputer that it is investigating a cybersecurity incident, following claims by the data extortion group ExfilSquad, which asserts it has stolen sensitive information from the company.
Jennifer Sniderman, Wesco's vice president of corporate communications, clarified that the incident concerns the company's cloud CRM environment: "Wesco is aware of an allegation of CRM data exfiltration by a third party. We have been working with our cloud CRM provider on this issue, and we do not believe there is a risk to sensitive data."
Wesco claims to have detected the incident quickly and that its investigation found no evidence of ransomware or other malware on its computer systems. The company indicates it has not experienced any disruption to its operations and that all processes are continuing normally. It believes that information related to payment cards, financial accounts, or other sensitive data of its customers and employees is not at risk.
ExfilSquad's claims: 2.6 million records
ExfilSquad, an emerging extortion group identified in mid-2026, released the data allegedly exfiltrated from Wesco's systems after the deadline imposed on the company to begin ransom negotiations expired. According to the group, the theft concerns 2.6 million records containing:
- personal identification information (PII) of customers and employees;
- account and contact data;
- CRM user profiles;
- credit identifiers and business identifiers;
- authentication metadata and access information.
Wesco has not confirmed these figures. When questioned by BleepingComputer about the details of ExfilSquad's claims, the company did not respond to further inquiries.
Who is Wesco?
Wesco is a Fortune 500 company specializing in the distribution of electrical, electronic, communication, security, utility, and broadband products, while also providing logistics and supply chain services to businesses. The company employs around 21,000 people and operates over 700 distribution centers, processing centers, and sales offices in about fifty countries. It generated approximately $24 billion in revenue last year.
The stakes are therefore considerable: a player of this size, a key link in critical supply chains, constitutes a prime target for groups seeking to maximize extortion pressure.
ExfilSquad: a group that does not use ransomware
According to a detailed report published on August 7, 2026, by cybersecurity firm Resecurity, ExfilSquad stands out from traditional ransomware groups by its method: it does not deploy ransomware or destructive malware. Instead, the group infiltrates poorly configured systems, exfiltrates data, and then threatens to publish it on its leak site (Data Leak Site, DLS) accessible via the Tor network, unless a ransom is paid.
Resecurity notes that ExfilSquad recently issued a firm deadline of August 5, 2026 to conclude all negotiations, failing which the data would be made public. On August 7, the group indeed uploaded torrent files for each victim, proving the credibility of its threats.
According to analyses by Resecurity and the firm VenariX, ExfilSquad systematically targets poorly configured Microsoft Power Pages, where Microsoft Dataverse data tables are accessible to anonymous users due to excessive permissions. VenariX examined samples associated with 11 of the 15 victims claimed by the group and found structures consistent with Microsoft Dataverse in all cases.
Wesco did not specify how the attacker accessed its network, but publicly available information indicates that the company uses Microsoft Dynamics 365, which is consistent with ExfilSquad's mode of operation.
A wave of attacks affecting many organizations
The attack on Wesco is just one episode of a much larger campaign. According to Resecurity's report, ExfilSquad has targeted at least 13 organizations in the United States, the United Kingdom, and Sweden, including:
| Victim | Claimed Records |
|---|---|
| City of Houston | ~6 million |
| City of Atlanta | ~3 million |
| Frontier Airlines | ~2.4 million |
| Wesco International | ~2.6 million |
| TaylorMade & Sun Day Red Golf | ~2 million |
| Allstate | ~657,000 |
| UK Department for Education | ~600,000 |
| Newcastle University | ~440,000 |
| Viavi Solutions | ~430,000 |
| Bonava (Sweden) | ~842,000 |
| Police National Legal Database (UK) | ~135,000 |
| DC Public Schools | ~60,000 |
The group has also claimed a hack of Zenith Bank in Nigeria (90 million records, 874 GB), but these claims have since been removed from their site — leaving it unclear whether a payment was made or for other reasons.
Troubling precedents: Analog Devices and the UK PNLD
ExfilSquad made headlines notably with its attack on Analog Devices (ADI), a major American semiconductor company. ADI officially stated to the SEC that it detected unauthorized access to some of its systems on June 23, 2026. ExfilSquad then announced the theft of over 570,000 records, but ADI has since been removed from the group’s leak site — suggesting again a possible transaction.
The group also targeted the Police National Legal Database (PNLD) in the UK, the legal reference system used by the 43 police forces of England and Wales. The breach exposed the names and work email addresses of over 100,000 police officers and criminal justice professionals, published on the dark web. The National Crime Agency (NCA) in the UK is investigating the incident, which also affected the public service "Ask the Police." The PNLD, which uses Microsoft Power Platform technology, perfectly matched the profile of ExfilSquad's victims.
Potentially minor members
One striking element from Resecurity's investigation: during an interview with a representative of ExfilSquad, it was suggested that teenagers might be involved in the group's activities. The Times of Britain reported that "many young people are drawn to hacking because it feels like a game — it offers recognition, a sense of identity, community, and a lot of power."
The representative also confirmed that the group targets Microsoft Power Pages data tables that are not properly secured. Resecurity currently does not link ExfilSquad to a known ransomware conglomerate or a state-backed actor.
An unprecedented torrent distribution tactic
Another notable aspect of ExfilSquad's operations is the systematic use of torrent files to distribute the stolen data. According to Resecurity, each victim is assigned a unique torrent tracker and an initial web seed, making the group’s operations harder to trace than those of actors using a single tracker.
This approach, already used by groups like LockBit 3.0 and Cl0p, ensures that data, once published, can no longer be deleted: participants in the P2P network can continue to disseminate it indefinitely. Resecurity identified over 50 active seeds, with hosts located in China and Russia among the earliest.
Recommendations and lessons learned
The Wesco incident and the broader campaign of ExfilSquad highlight a major risk: default or overly permissive configurations of Microsoft Power Pages can expose substantial volumes of data to anyone, without even requiring authentication. VenariX recommends organizations using Power Pages to:
- check table permissions for anonymous users;
- audit Web API and legacy OData feed settings;
- test access from an unauthenticated browser session to validate the configuration.
Microsoft offers a tenant-level control to block Dataverse data reading by unauthenticated users while allowing submissions of public forms — a setting that should have been validated before deployment, not after a breach.
For Wesco, whose investigation is ongoing, the central question remains whether the 2.6 million records claimed by ExfilSquad actually correspond to exposed data, and to what extent customer and employee information has been compromised. The divergence between the company's assurances ("no risk to sensitive data") and the extortion group's claims (PII, authentication metadata, access information) will need to be clarified in the coming weeks.