Wesco Investigates Data Breach After ExfilSquad Claims Theft of 2.6 Million Records On August 11, 2026, global supply chain and distribution company Wesco confirmed it is investigating a cybersecurity incident following claims by the data extortion group ExfilSquad that it stole and leaked 2.6 million records from the company’s cloud CRM environment. Wesco stated that no business disruption occurred, no ransomware or malware was detected on internal systems, and sensitive customer or employee data including payment card or financial account information was not believed to be at risk. However, ExfilSquad’s leak allegedly includes personally identifiable information (PII), account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access-related details, raising concerns about downstream phishing, business email compromise (BEC), and fraud risks for Wesco’s partners and customers. The attack appears to have targeted Wesco’s cloud CRM system, likely based on Microsoft Dynamics 365, with potential exploitation of misconfigured Microsoft Power Pages data tables. ExfilSquad, known for extortion-only operations, typically gains initial access via compromised credentials or exposed cloud applications, then uses legitimate tools like 7z, rclone, and PowerShell to stage and exfiltrate data to attacker-controlled cloud storage (e.g., MEGA, pCloud). The group’s tactics align with the MITRE ATT&CK framework, including valid account abuse (T1078), cloud service discovery (T1526), and exfiltration over web services (T1567.002). No malware was detected, and all activities leveraged dual-use administrative tools, complicating detection. ExfilSquad has a history of targeting supply chain, education, and public sector organizations, with prior breaches at Analog Devices, the UK’s Police National Legal Database, and Newcastle University. The stolen data reportedly containing customer lists, shipment details, and project pricing poses significant third-party risk, as it can be weaponized for spear phishing and invoice fraud across Wesco’s ecosystem. Key Timeline: - August 7, 2026: ExfilSquad begins distributing stolen data via torrents. - August 11, 2026: Wesco confirms the incident after ExfilSquad publishes the leaked data following failed ransom negotiations. As of the report date, no technical indicators of compromise (IOCs) beyond a single domain (mallory[.]ai) have been publicly disclosed, and no regulatory filings or law enforcement advisories have been referenced. The incident underscores the growing threat of data theft extortion targeting cloud environments, particularly in sectors handling sensitive partner data.