Is ExfilSquad in Your Power Pages?

ExfilSquad is targeting your Microsoft Power Pages right now. And no, this isn't some highly sophisticated, nation-state cyber warfare that requires a master key to breach. It's much more embarrassing than that. Organizations love to talk about advanced persistent threats and complex zero-day exploits. But the reality is far more mundane. Security teams are practically leaving their digital front doors wide open. The extortion group known as ExfilSquad is currently vacuuming up massive amounts of sensitive data from Microsoft Power Pages. They aren't hacking. They're simply reading what you left exposed. The culprit? A simple Power Pages misconfiguration involving anonymous web roles. Microsoft designed Power Pages to quickly build external-facing websites. But in the rush to deploy, developers are granting Dataverse anonymous access to sensitive tables. ExfilSquad doesn't need to crack your firewalls. They're just exploiting the default settings and sloppy permissions you forgot to double-check. Let's break down the reality of this Microsoft Power Pages data leak. First, the anonymous web role problem is entirely self-inflicted. When you assign table permissions to the anonymous web role, you're telling the internet that anyone can read that data without authentication. We're seeing healthcare records, employee lists, and proprietary business data exposed. Why? Because developers assume a page is hidden just because there is no link to it on the homepage. Which, let's be honest, is a pretty wild assumption to make. But scanners don't need links to find your data. Second, the extortion risks are real and immediate. Once ExfilSquad identifies these open Dataverse endpoints, they automate the data exfiltration using simple scripts. Within hours, they've downloaded your entire dataset and sent you a ransom demand. They don't encrypt your systems. Instead, they threaten to leak your data publicly. That drags your organization into regulatory and reputational ruin. Third, implementing Power Pages security best practices isn't rocket science. It simply requires enforcing least-privilege access control. You need to go into your Power Platform admin center, audit your web roles, and disable anonymous access for any table containing personally identifiable or proprietary data. If a table doesn't absolutely require public visibility, restrict it to authenticated users. Don't wait for a ransom note to tell you that your settings are wrong. Run a permissions audit on your Microsoft Power Pages today. Secure your Dataverse tables, and shut down anonymous access before ExfilSquad does it for you.