Misconfigured Power Pages Leaks 27 Million Records Online

A recent security incident has exposed approximately 27 million records across 13 organizations after data-extortion group ExfilSquad published alleged victim data via torrent distribution. The evidence points to a misconfigured Microsoft Power Pages setup, rather than a zero-day exploit or network intrusion.

Researchers from Fortra's Intelligence and Research Experts (FIRE) found that the datasets structurally resembled exports from Microsoft Dynamics 365 CRM and ERP environments backed by Dataverse. The leading hypothesis is that affected portals assigned the Anonymous Users web role to Dataverse table permissions, granting public read access.

The incident underscores a recurring cloud-security reality: legitimate SaaS features can become internet-accessible data-exfiltration channels when configured with overly broad anonymous permissions. Organizations should review their Power Pages setup and ensure that table permissions do not grant public read access unnecessarily.