ExfilSquad data leaks substantiate broad breach claims

Cybersecurity researchers have found evidence that ExfilSquad obtained sensitive information belonging to at least 13 organisations, strengthening earlier claims by the emerging extortion group after it began distributing stolen datasets through torrent networks.

The disclosures cover organisations in the United States, Britain and Sweden and span government, education, aviation, insurance, technology and consumer services. Investigators examining the material say the leaked files contain personally identifiable information, customer records, internal case-management data and other sensitive information.

ExfilSquad surfaced publicly in July 2026 and differs from conventional ransomware operators because it appears to concentrate on stealing information rather than encrypting computer systems. Victims are threatened with publication of the stolen material unless negotiations take place.

The group initially attracted scepticism after announcing numerous prominent targets within a short period and providing limited supporting evidence. That assessment changed after torrent files linked to individual victims appeared on its dark-web leak site in early August. Researchers examining those files concluded that substantial datasets were circulating and that the group had access to information associated with multiple named organisations.

The affected organisations listed in the analysis include Wesco International, the UK Department for Education, the Police National Legal Database, Allstate, TaylorMade and Sun Day Red Golf, Frontier Airlines, District of Columbia Public Schools, Newcastle University, Viavi Solutions, the cities of Houston and Atlanta, and Swedish property developer Bonava.

Researchers estimate that the Wesco dataset contains about 2.6 million records involving customers and employees. The material is said to include contact information, customer relationship management profiles, business identifiers and authentication-related metadata.

Data linked to the UK Department for Education includes roughly 600,000 records associated with a help portal and another 7,000 records connected with the Turing Scheme portal. The exposed information includes names, email addresses, telephone numbers and job titles. The department has acknowledged unauthorised access involving customer-service contact information and said affected systems were secured.

The Police National Legal Database breach has produced particularly sensitive disclosures. More than 100,000 records relating to police personnel and criminal justice professionals were compromised. The data includes names, work email addresses and information identifying police-force areas.

Newcastle University has also confirmed unauthorised access after investigators found a configuration problem affecting a connection to an admissions system. The university said exposed material was limited to contact information such as names, addresses, telephone numbers and email addresses and did not contain examination results or admissions decisions. ExfilSquad claimed a considerably larger dataset of about 440,000 records.

Other claims involve significantly larger volumes. ExfilSquad says it obtained approximately six million records connected with Houston municipal systems, including resident contact details, service requests, addresses, complaints and case-management information. Its Atlanta dataset is described as containing about three million records involving citizen service requests, addresses and municipal case histories.

Researchers have not independently established every numerical claim made by the criminals, and the presence of a company on an extortion site does not by itself prove the full scope of a breach. Some organisations named by ExfilSquad have not publicly confirmed the incidents or the quantities of information claimed by the group.

The torrent releases nevertheless provide more substantial evidence than the screenshots and assertions that accompanied ExfilSquad’s first announcements. Peer-to-peer distribution also makes containment substantially more difficult because downloaded material can continue circulating even if the original hosting infrastructure disappears.

ExfilSquad appears to have focused heavily on customer relationship management systems, cloud applications and externally accessible portals. Investigators have identified poorly secured Microsoft Power Pages, Dataverse environments, case-management platforms and similar services as possible avenues through which large datasets may have been exposed.

That approach allows an attacker to steal large collections of structured information without necessarily penetrating every part of an organisation’s internal network. Customer-service systems can contain years of correspondence, addresses, account information, support histories and internal notes, making them particularly valuable for extortion and subsequent fraud.

The group has also claimed Frontier Airlines data comprising about 2.4 million records, including customer-support cases, travel information, baggage details and correspondence. Separately disclosed security incidents affecting the airline complicate attribution, leaving uncertainty over whether all information claimed by ExfilSquad originated from access controlled exclusively by the group.

District of Columbia Public Schools was listed with approximately 60,000 records. Researchers examining the published material found that the attackers had withheld children’s underlying information from the public torrent and released sanitised samples instead.