A relatively new extortion crew called ExfilSquad has published a fresh slate of targets this week, according to securityaffairs.com. Investigators at Resecurity say the group first surfaced in mid-2026 and prefers a leak-only model: it grabs sensitive files and then pressures the owners for payment.
This round includes 13 organizations spread across the US, the UK and Sweden. The same group also went after a major financial institution in Nigeria in July, Resecurity adds.
The short version
- 13 organizations across the US, UK and Sweden named this week.
- Deadline for payment: August 5, 2026.
- Earlier in July, the group hit a major financial institution in Nigeria.
- The UK Police National Legal Database breach compromised contact data for over 100,000 officers and criminal justice workers.
- Each victim is assigned its own torrent tracker and web seed.
Why torrents change the math
Traditional leak sites live on a small number of onion domains that defenders can monitor, flag and sometimes seize. ExfilSquad skips that pattern entirely and distributes stolen archives through P2P networks, with each campaign getting a unique tracker. Once peers start seeding, Resecurity notes, pulling the data back is functionally impossible: anyone who grabbed the file can resume sharing it indefinitely.
Resecurity's analysts examined the swarm activity and seeds taking part in the circulation of exfiltrated material. Hosts inside China and Russia were among the loudest participants on August 7, which may suggest prior knowledge of the release or simply opportunistic interest. Either way, the geographic spread makes takedowns harder, not easier.
Our analysis
The interesting design choice here is what the group omits. There is no encryption stage, no ransom note pointing at a Tor negotiation portal, no decryptor key. Pure data theft followed by public embarrassment. That simplification cuts the operator's own risk surface: fewer custom tools, fewer infrastructure pieces to defend, less to go wrong during an intrusion.
The entry path is the bigger worry for defenders. ExfilSquad leans on misconfigured cloud and SaaS products: Microsoft Dataverse environments, Power Pages sites, and broad-access CRM setups. These are not exotic zero-days. They are configuration mistakes that automated scanners sweep for continuously. Any partner with read access to your records through a poorly tuned portal is now a viable door.
The UK Police National Legal Database incident is the proof of concept. Contact records for over 100,000 officers and justice workers do not lose value with time; they gain it. Expect follow-on phishing, credential stuffing and social engineering aimed at those names for years.
What it means for you
Say you expose a Dataverse or Power Pages endpoint to partners and contractors. Spend an afternoon walking through those external-facing surfaces with a fresh set of credentials and a search engine. Look for tables or contact fields that should never have been world-readable. The cost of finding the leak yourself is a few hours of work; the cost of finding it in a torrent swarm is measured in regulatory fines and customer trust.
Also drag your IR plan out of the ransomware drawer and write a sibling document for leak-only events. Ransomware playbooks lean on recovery from backups. Leak playbooks lean on containment, disclosure timing and a clear legal posture, because the data is already out the door.
What to watch next
The August 5 deadline will pass, and then the question is whether ExfilSquad publishes or holds. Either answer is informative. Watch torrent trackers, monitor paste sites, and pay attention to whether overlapping infrastructure connects this round to the Police National Legal Database breach. Copycats tend to copy the playbook that works, so expect similar cloud-portal targeting to spread.
Key takeaways
- ExfilSquad named 13 victims across the US, UK and Sweden with an August 5 deadline.
- Leaks are distributed through P2P torrents with unique trackers, making them effectively permanent.
- The group exploits misconfigured Dataverse, Power Pages and CRM portals rather than deploying ransomware.
- Defenders need a dedicated hack-and-leak response playbook alongside the ransomware one.
Frequently asked questions
Who is ExfilSquad?
A cybercrime crew that appeared in mid-2026 and focuses on data theft and public leaks rather than ransomware encryption.
Who is on the new victim list?
13 organizations across the US, the UK and Sweden, plus a major Nigerian financial institution targeted in July.
Why bother with torrents at all?
Torrents make leaked data very hard to suppress, because any peer who downloaded it can keep seeding.
Which systems does ExfilSquad abuse?
Cloud and SaaS products, especially misconfigured Microsoft Dataverse, Power Pages and CRM platforms.
What is the most damaging past breach?
The UK Police National Legal Database, which exposed contact data for more than 100,000 officers and criminal justice workers.
Source: securityaffairs.com