Cyber Threat Actor: ExfilSquad

ExfilSquad is an extortion group that has been observed operating under the alias ExfilSquad. The group came to public attention in August 2026 when researchers linked it to a series of data leaks affecting thirteen organizations. The actors identify themselves as an extortion group in their communications and claim to have destroyed original files after releasing censored versions of the stolen data.

The group’s targeting has focused on entities in the education and government sectors, including public school districts, national education departments, and municipal administrations. In the observed incidents they compromised the District of Columbia Public Schools, the UK Department for Education, and the City of Atlanta, among others. Their stated objective is to extort payment from victims, and they follow through with data publication when demands are not met.

The actors’ typical initial access vector involves exploiting misconfigured Microsoft Power Page portals that grant public read access to underlying Dataverse tables. By leveraging these misconfigurations they are able to exfiltrate large volumes of data without deploying custom malware or exploiting platform vulnerabilities. The observed tooling consists of using the exposed portals to export Dataverse data and then packaging the material for distribution via torrent files. No specific malware families or exploit kits are referenced in the reporting.

The August 2026 operation represents the group’s most prominent campaign to date, affecting thirteen organizations and resulting in the release of approximately 382 gigabytes and twenty‑seven million records. Within this campaign a censored leak of roughly sixty thousand student records from the District of Columbia Public Schools was highlighted as an example of the data they possessed. The group claimed to have destroyed the original files after publishing the censored version and asserted that the victims had not met their extortion demands. These details constitute the publicly reported operations attributed to ExfilSquad.