Cybersecurity Alert: Threat Actors Actively Targeting Financial Services Firms via Microsoft Power Pages Misconfiguration

Member firms should be aware of a significant security threat that can result in unauthorized access to member firm data stored in Microsoft Dynamics 365 (D365) environments via misconfigured Microsoft Power Pages portals. A threat actor group known as ExfilSquad is conducting an ongoing data extortion campaign targeting organizations across multiple sectors, including financial services firms. The group exploits misconfigured permissions to gain unauthorized access to databases containing personally identifiable information (PII) of customers and employees, and threatens public disclosure of compromised data unless ransom demands are met. This alert describes the threat and includes recommendations to help firms identify potential exposure and mitigate risks.

Background

ExfilSquad is a threat actor group first identified in mid-2026 that has gained notoriety for conducting high-profile data breaches across the education, government, and technology sectors. The group employs a double-extortion tactic, exfiltrating sensitive data and threatening to publish it on dark web forums unless a ransom is paid. 

The group's primary attack vector involves exploiting misconfigured Microsoft Dynamics 365 Power Pages portals. Specifically, ExfilSquad targets Dataverse table permissions that have granted the Anonymous Users web role overly broad read access to sensitive entities via the Power Pages web API. This misconfiguration allows any unauthenticated visitor to query and extract sensitive data, including customer and employee PII, directly from exposed Dataverse tables. Microsoft's own documentation advises against assigning the Anonymous Users web role to table permissions on publicly exposed sites.

Automated scanning tools, including publicly known attack tools such as “Power Pwn,” have been observed actively scanning for exposed Power Pages instances. More than 10,000 potentially vulnerable public-facing Power Pages instances have been identified.

Importantly, available evidence does not indicate exploitation of a software vulnerability within D365 itself, nor classic network-level ransomware activity. This campaign appears limited to Software as a Service (SaaS) data exfiltration and data extortion, with observed data exports consistent with Dataverse formats.

Indicators of Compromise

Firms that may have been exposed should examine their environments for the following indicators:

• anomalous unauthenticated API or browser requests to “/_api/” or “/_odata/” endpoints;
• bulk or high-volume Dataverse entity queries, including pagination abuse¹;
• unexpected data access to sensitive tables (e.g., systemuser, contact, incident, email, annotation); and
• dark web activity referencing the firm's customer or employee PII.

Recommendations to Protect Your Firm

FINRA recommends that member firms that utilize Microsoft Dynamics 365 or Microsoft Power Pages engage their IT department, technology vendor, or managed service provider to confirm that the following measures have been implemented. Firms that are uncertain whether they use either of these platforms should promptly determine whether they do.

• Restrict Unauthorized Access: Firms should immediately audit and remediate Power Pages and Dataverse configurations to eliminate unauthorized external access. This includes disabling anonymous access, removing the Anonymous Users web role from all table permissions, and restricting web API access to only operationally necessary tables. Following remediation, firms should validate that unauthenticated access attempts return an authorization error. Refer to Microsoft's Power Pages Security Documentation for detailed implementation guidance.
• Strengthen Authentication Controls: Firms should disable device code flow authentication tenant-wide and require fresh multi-factor authentication (MFA) challenges for all access to sensitive cloud applications, including but not limited to Microsoft Dynamics 365 and Microsoft Power Platform. Where device code flow exceptions are operationally necessary, access should be scoped narrowly and monitored closely. Refer to Microsoft's Conditional Access and Zero Trust guidance for implementation steps.
• Enable Monitoring and Detection: Firms should enable Dataverse auditing and activity logging across all Power Platform and Dynamics 365 environments and monitor sign-in and access logs for anomalous patterns. Firms are strongly advised to preserve all current configuration snapshots and logs prior to implementing remediation changes, as this information may be critical for investigative and regulatory purposes. Refer to Microsoft's Dataverse Auditing and Activity Logging guidance for further detail.

Firms should also review their vendor risk management programs to ensure they have processes in place to respond to third-party security incidents, including policies, procedures, and controls related to cloud platform configuration and third-party service management. Related effective practices can be found in the Third-Party Risk Landscape section of the 2026 FINRA Annual Regulatory Oversight Report.

For questions related to this alert or other cybersecurity-related topics, contact the FINRA Cyber and Analytics Unit (CAU). Both the FBI and CISA urge you to promptly report cyber incidents to a local FBI Field Office, the FBI Internet Crime Complaint Center (IC3) at IC3.gov, or CISA via CISA’s 24/7 Operations Center ([email protected] or 888-282-0870).

Note: This alert does not create new legal or regulatory requirements or new interpretations of existing requirements, nor does it relieve firms of any existing obligations under federal securities laws, regulations, and FINRA rules. Member firms may consider the information in this alert in developing new, or modifying existing, policies and procedures that are reasonably designed to achieve compliance with relevant regulatory obligations based on the firm’s size and business model.