ExfilSquad Claims Breaches of 15 Organizations; UK Police Database Confirms Compromise

Summary

DarkOwl profiles ExfilSquad, which claims breaches of 15 organizations. The UK Police National Legal Database confirmed that contact information affecting more than 100,000 police officers and staff was compromised and published; other claims remain unverified.

Key points

ExfilSquad listed 15 alleged victims across the US, UK, Sweden, and Nigeria on its onion-based leak site, with ransom deadlines and sample files or torrent links.
The UK Police National Legal Database confirmed police, government, and customer contact information was compromised and published, affecting more than 100,000 UK police officers and staff.
The group promoted claims involving the UK police database and Department for Education on the Spear and PwnForums dark-web forums on July 25, 2026.
DarkOwl observed an ExfilSquad account on each forum; the Spear account had been inactive since July 27, 2026, when the article was written.
The article says claims concerning other listed victims have not been independently verified.

Article Details

Attack Vectors: ExfilSquad claims to have breached multiple organizations and uses extortion, listing alleged victims, ransom deadlines, and sample files or torrent links on a dedicated onion-based data leak site.
The actor promoted alleged breaches and shared sample data and links to its data leak site on the Spear and PwnForums dark web forums.
Defensive Notes: The article advises allegedly affected organizations to give the claims serious attention; it does not provide specific technical mitigation guidance.

Threat Actors

ExfilSquadA newly emerged group claiming responsibility for multiple breaches and extortion listings; the UK Police National Legal Database confirmed that police, government, and customer contact information was compromised and published by the group.

Countries

NigeriaThe alleged victims span the United States (9 victims), the United Kingdom (3 victims), Sweden (1 victim), and Nigeria (1 victim).SwedenThe alleged victims span the United States (9 victims), the United Kingdom (3 victims), Sweden (1 victim), and Nigeria (1 victim).United KingdomThe alleged victims span the United States (9 victims), the United Kingdom (3 victims), Sweden (1 victim), and Nigeria (1 victim).United StatesThe alleged victims span the United States (9 victims), the United Kingdom (3 victims), Sweden (1 victim), and Nigeria (1 victim).

Industries

AirlinesFrontier Airlines BankingEducationUK Department for Education (education.gov.uk)Governmentweb listings is that the UK Police National Legal Database (PNLD) has publicly confirmed that police, government, and customer contact information was compromised and published by the ExfilSquad group, with over Law enforcementitself through a simultaneously broad victim portfolio, a confirmed breach of a sensitive law enforcement database, and active cross-platform promotion across multiple dark web forums.real estateBonava, the Swedish residential real estate development company headquartered in Stockholm, Sweden.