I ended last week's issue by joking that I'd revisit the state of Power Pages portals and Dataverse customer data security in 2031. But here I am, back covering the ExfilSquad incident. Because as they say, never let a good crisis go to waste. This week, I’ll be looking at:

The Times UK published an interview with a member who says he represents ExfilSquad — a group of mostly teenagers who are hacking the government for fun. Not primarily for money, but to establish a name for themselves.

The interview tells how these kids see hacking as game-like: all about recognition, community, identity. It’s about gaining “power” via targeting Power Pages — not quite the type of image Microsoft’s product marketing had in mind for the brand, I bet.

It’s worth stressing again that this hacking didn’t involve exploiting any 0-days or finding proper software vulnerabilities. Instead, the weak spot was in how organizations deploy this technology and end up leaving confidential customer and public officials data exposed to the public web. The ExfilSquad founder said it was ‘stupid easy’ to get to this data. The article also makes it clear that the group was doing a broad sweep looking for insecure Power Pages data tables specifically.

We often imagine a major enterprise breach as the result of highly sophisticated adversaries overcoming highly sophisticated defenses. Here, the skill imbalance may have been the opposite: the attacker understood the public-facing data model and Power Pages site configuration better than the owner. Once the group identified exposed systems from online scans, the data collection itself was trivial.

One thing to keep in mind when investigating this kind of topic is that the majority of cybersecurity incidents are not publicly reported. For example, 85% of ransomware attacks go unreported to law enforcement (BlackFrog 2025 Q3 data). More than half of cybersecurity professionals globally have been pressured to keep security breaches undisclosed (Bitdefender June 2025 report). What these stats mean in practice is that we’re only going to see a small slice of the actual security issues if relying on customer and vendor formal disclosure.

Some official sources are needed to validate that this is more than a publicity scam, though. Out of all the claimed victims of ExfilSquad, here are the ones that have disclosed the incident in a way that I was able to find online evidence for while writing this newsletter issue:

Let’s look at one example of such a statement: Newcastle University’s.

Such notes rarely identify the exact technology used by the compromised systems. The signals are consistent with a Power Pages site whose security configuration allowed unauthenticated retrieval through the Web API.

Looking across the various cybersecurity firms with blog posts on this topic, it’s not easy to determine what has truly been seen in evidence and what is merely inferred from the claims made by the attackers. Still, the general structure of it looks quite logical:

If you’ve worked in Dynamics 365 projects, this looks very familiar. These are the kinds of tables and columns you’d model and manage inside Dataverse databases. They do not look like random files and exports acquired from a compromised employee laptop.

The Times interview presented the teenage gang as doing this ‘for fun’, not expecting to get any money from the victims. Based on new reports, that doesn’t seem to be entirely true. Some organization names have been removed from ExfilSquad’s list, while others have had their data published via torrent files:

“After all, why not? Why shouldn’t I make some money from this data I grabbed from Power Pages sites?” Just because the criminals are young, that doesn’t mean they’d be naive. Once you’ve crossed the barrier and conducted unlawful activities on IT systems, it must be easy to just keep going and gain not just more fame but also more dough.

So we get to the stage of the game where the ransom is either paid or not. If it is, the group may claim to erase the data they hold. If not, then P2P distribution of data is initiated — making it in practice impossible to ever get that leaked data removed from the internet.

I haven’t ever been in a position where a company that I had worked with or at would have faced this type of extortion. I can only imagine the stress levels of being involved in a Power Platform project that gets associated with a data breach incident. The allegations would most certainly be all over the place, with people in high positions and with low understanding of the underlying technology making life very difficult for those who are trying to figure out what actually led to this disastrous outcome for the business.

I have not seen any statements from representatives of Microsoft on these incidents, which of course isn’t too surprising. It wouldn’t be appropriate for the vendor to point a finger at the customers/partners who created an unsafe business solution from the SaaS building blocks provided to them. I’m certain that behind the scenes there is lots of activity and collaboration with the impacted parties. This is not a moment for making any publicity stunts or marketing pitches about the technological aspects but rather it’s all about confidentiality first.

But what a nice coincidence this M365 Admin Center message MC1449988 just happens to be! A Power Pages hotfix announcement that dropped later on the same day as my previous newsletter issue, addressing anonymous Web API access. What are the odds of an emergency update dropping out of the blue sky at this very moment?

Since I haven’t seen this indexed in any of the public websites replicating Microsoft’s “secret” Message Center messages, let me paste the text from my tenant here for others to find it online:

The maintenance window for non-production environments in my tenant is Aug 13 6:00 PM UTC (Thursday) to Aug 14 3:00 AM UTC (already past). For production environments, it’s Aug 15 6:00 PM UTC (Saturday) to Aug 16 3:00 AM UTC. This meant one week’s notice for anyone with Power Pages websites to get their configuration checked. Or face potential downtime from a site broken by the new behavior Microsoft rolled out as part of this hotfix.

Cloud platform providers don’t roll out these kind of changes with such a schedule unless there’s a clear and present danger of either more attacks from malicious actors, or a potential legal liability that must be addressed to minimize the damages. Again, this is not a bug in Microsoft’s system. But just like five years ago, that doesn’t mean there wouldn’t be reasons to make considerable changes to the software as a response to such news breaking out.

What the MC1449988 hotfix does is, in my opinion, a perfectly logical change to be made. It is something that should have been made much earlier, like in 2024 when the security researchers warned about it. What’s especially important to understand here is that this change alone does not solve the entire problem outlined in AppOmni’s report.