The Financial Industry Regulatory Authority (FINRA) has issued a warning to financial services firms regarding a significant security threat that can result in unauthorized access to member firm data stored in Microsoft Dynamics 365 (D365) environments via misconfigured Microsoft Power Pages portals.

A threat actor group known as ExfilSquad is conducting an ongoing data extortion campaign targeting organizations across multiple sectors, including financial services firms. The group exploits misconfigured permissions to gain unauthorized access to databases containing personally identifiable information (PII) of customers and employees, and threatens public disclosure of compromised data unless ransom demands are met.

ExfilSquad is a threat actor group first identified in mid-2026 that has gained notoriety for conducting high-profile data breaches across the education, government, and technology sectors. The group employs a double-extortion tactic, exfiltrating sensitive data and threatening to publish it on dark web forums unless a ransom is paid.

The group’s primary attack vector involves exploiting misconfigured Microsoft Dynamics 365 Power Pages portals. Specifically, ExfilSquad targets Dataverse table permissions that have granted the Anonymous Users web role overly broad read access to sensitive entities via the Power Pages web API. This misconfiguration allows any unauthenticated visitor to query and extract sensitive data, including customer and employee PII, directly from exposed Dataverse tables. Microsoft’s own documentation advises against assigning the Anonymous Users web role to table permissions on publicly exposed sites.

Automated scanning tools, including publicly known attack tools such as “Power Pwn,” have been observed actively scanning for exposed Power Pages instances. More than 10,000 potentially vulnerable public-facing Power Pages instances have been identified.

Importantly, available evidence does not indicate exploitation of a software vulnerability within D365 itself, nor classic network-level ransomware activity. This campaign appears limited to Software as a Service (SaaS) data exfiltration and data extortion, with observed data exports consistent with Dataverse formats.

FINRA recommends that member firms using Microsoft Dynamics 365 or Microsoft Power Pages engage their IT department, technology vendor, or managed service provider to confirm that the following measures have been implemented:

• Restrict Unauthorized Access: Firms should immediately audit and remediate Power Pages and Dataverse configurations to eliminate unauthorized external access. This includes disabling anonymous access, removing the Anonymous Users web role from all table permissions, and restricting web API access to only operationally necessary tables. Following remediation, firms should validate that unauthenticated access attempts return an authorization error.
• Strengthen Authentication Controls: Firms should disable device code flow authentication tenant-wide and require fresh multi-factor authentication (MFA) challenges for all access to sensitive cloud applications, including but not limited to Microsoft Dynamics 365 and Microsoft Power Platform. Where device code flow exceptions are operationally necessary, access should be scoped narrowly and monitored closely.
• Enable Monitoring and Detection: Firms should enable Dataverse auditing and activity logging across all Power Platform and Dynamics 365 environments and monitor sign-in and access logs for anomalous patterns. Firms are strongly advised to preserve all current configuration snapshots and logs prior to implementing remediation changes, as this information may be critical for investigative and regulatory purposes.

Firms should also review their vendor risk management programs to ensure they have processes in place to respond to third-party security incidents, including policies, procedures, and controls related to cloud platform configuration and third-party service management.