Microsoft Power Pages Misconfigurations Expose 27 Million Records in Mass Data Leak A suspected misconfiguration in Microsoft Power Pages has led to the exposure of 27 million records across 13 organizations, after the data-extortion group ExfilSquad published 382.64 GB of stolen data via torrent on August 7. Researchers from Fortra’s Intelligence and Research Experts (FIRE) determined that the breach stemmed from publicly readable Microsoft Dataverse tables not a zero-day exploit, ransomware, or traditional network intrusion. The incident highlights a critical cloud-security risk: overly permissive anonymous access settings in Power Pages, a tool designed to create external-facing web portals connected to Microsoft Dynamics 365 CRM and ERP environments. The leading hypothesis suggests that affected portals granted the Anonymous Users web role read access to sensitive Dataverse tables, allowing unauthenticated visitors to retrieve records via exposed API endpoints. Unlike conventional breaches, ExfilSquad did not rely on malware, credential theft, or software vulnerabilities instead, the group exploited legitimate but misconfigured SaaS features to harvest data at scale. The exposed records included personally identifiable information (PII), CRM data, student records (names, birth dates, unique identifiers), and government service records, posing risks for spear-phishing, identity fraud, and follow-on attacks. Reported victims span government and education sectors, including the City of Atlanta, the UK Department for Education, and District of Columbia Public Schools. The incident underscores a broader trend: cloud data exposure can be automated and mass-harvested once a portal’s API is publicly accessible, even without internal network compromise. Security teams are advised to audit Power Pages deployments, removing the Anonymous Users role from tables unless explicitly required for public access. Where anonymous access is necessary, permissions should be narrowly scoped, and API responses should be tested from unauthenticated sessions to prevent unintended data leaks. Microsoft has since restricted wildcard API configurations for certain system tables to mitigate such risks. The breach serves as a reminder that identity and authorization misconfigurations can turn a customer portal into an open data-export interface, exposing organizations to significant privacy and fraud risks.