Wesco Investigates Cloud CRM Incident Following ExfilSquad Data Leak

Data extortion group ExfilSquad has published a data dump allegedly containing 2.6 million records taken from Fortune 500 supply chain giant Wesco, prompting the company to investigate an incident involving its cloud customer relationship management (CRM) environment.

Wesco confirmed the active investigation following claims made on ExfilSquad’s extortion leak site. While the threat actors allege they successfully exfiltrated vast stores of internal and customer data, Wesco maintains that its primary operations remain unaffected and that core financial and sensitive data was not compromised.

Incident Breakdown and ExfilSquad Claims

According to statements from Jennifer Sniderman, Vice President of Corporate Communications at Wesco, the incident is isolated to the company’s cloud-based CRM infrastructure. The company detected the activity quickly and engaged its cloud CRM vendor to assess the situation.

Wesco’s internal investigation confirmed that no ransomware or malicious software was deployed across its corporate IT network. Operations across its more than 700 distribution centers, fulfillment facilities, and sales offices across roughly 50 countries continue to function normally without operational disruption. Furthermore, Wesco states that it does not believe payment card information, financial account numbers, or other sensitive customer or employee data were compromised.

The threat group’s account of the breach paints a starkly different picture. After issuing a ransom demand that passed without compliance or negotiation, ExfilSquad published what it claims is a 2.6 million record dataset stolen directly from Wesco. According to the actors, the exfiltrated material includes customer and employee personally identifiable information (PII), account and contact records, CRM user profiles, credit and business identifiers, authentication metadata, and system access information.

Wesco is a major global player in supply chain services and distribution for electrical, communications, security, utility, and broadband products, generating approximately $24 billion in annual sales with a workforce of 21,000 employees. Because of the company’s central position in global logistics and infrastructure, any exposure of its business communications or contact databases poses immediate third-party risk down the supply chain.

Vulnerability Mechanics: Microsoft Power Pages Misconfigurations

While Wesco has not publicly disclosed the exact initial access vector, publicly available technical details indicate the company utilizes Microsoft Dynamics 365. Cybersecurity researchers at Resecurity and VenariX recently documented a distinct pattern in ExfilSquad’s operational playbook: exploiting misconfigured Microsoft Power Pages data tables to harvest underlying Dataverse records.

Microsoft Power Pages (formerly Power Apps portals) allows organizations to build low-code, externally facing web portals that connect to data stored in Microsoft Dataverse. By default, or through administrative misconfiguration, specific Dataverse tables can end up exposed to anonymous site visitors via the Power Pages Web API.

This class of vulnerability relies on authorization flaws rather than zero-day code execution bugs:

• Table Permissions Neglect: Administrators enable custom tables or standard CRM tables (such as Contacts, Accounts, or SystemUsers) for external display or API access but fail to explicitly enforce strictly scoped Table Permissions.
• Anonymous Access Enabled: When “Enable Table Permissions” is left unchecked or set to allow public read access, any unauthenticated attacker can query the OData endpoints exposed by the portal.
• Automated Data Scraping: Threat actors use automated scripts to enumerate exposed Dataverse entities, systematically pulling down entire database tables via basic HTTP GET requests without ever needing to compromise local endpoints or execute malware.

ExfilSquad has repeatedly leveraged this exact vector against major entities, previously targeting organizations like Analog Devices, Newcastle University, and the U.K.’s Police National Legal Database (where the group leaked details on over 100,000 police personnel).

Threat Actor Profile and Blast Radius

ExfilSquad operates strictly as a data extortion actor rather than a traditional ransomware group. Instead of deploying encryptors that cause operational downtime—which draws immediate, destructive attention—they focus on quiet, automated exfiltration of sensitive databases from loosely secured cloud applications and external web portals. Once the data is harvested, they issue extortion demands under threat of public leak.

For an enterprise of Wesco’s size, the realistic blast radius of a CRM table leak spans far beyond simple contact information disclosure:

1. Supply Chain Phishing and BEC: Detailed customer profile records, business identifiers, and account contact lists provide malicious actors with the precise blueprint needed to execute targeted business email compromise (BEC) campaigns. Attackers can forge convincing supply chain communications, redirect invoice payments, or launch spear-phishing attacks against Wesco’s corporate clients.
2. Credential Harvesting and Session Hijacking: If authentication metadata or CRM user profiles are included in the leaked dataset, threat actors can leverage this metadata to execute targeted credential stuffing or password-spraying attacks against employee remote access portals.
3. Downstream Partner Risk: Organizations relying on Wesco for utility and communications infrastructure now face elevated risks of secondary social engineering, as attackers exploit established business relationships using verified internal identifiers.

Remediating Power Pages and Dataverse Exposure

Organizations running Microsoft Dynamics 365 and Power Pages must immediately audit their public portal exposure to ensure Dataverse tables are protected against unauthorized API queries.

• Audit Power Pages Table Permissions: Open the Power Platform Admin Center or Power Pages Design Studio and review all active sites. Verify that Enable Table Permissions is explicitly turned on for every custom and standard table connected to the portal.
• Disable Anonymous Read Access: Ensure that no role assigned to anonymous users includes Read, Append, or Write privileges on sensitive Dataverse entities such as contact, account, or custom CRM tables.
• Disable Unused Web APIs: If your Power Pages portal does not strictly require external Web API access for custom portal interactions, turn off the site setting standard Webapi/<table_name>/enabled configuration completely.
• Implement Column-Level Security: For sensitive business attributes (such as tax IDs, internal metadata, or payment terms), enable Column Security Profiles within Dataverse so that even authenticated portal users cannot view high-value fields unless specifically authorized.