Wesco Investigates CRM Incident After ExfilSquad Claims Data Theft
Summary
Wesco says it is investigating a cloud CRM incident after ExfilSquad claimed to steal and publish 2.6 million records. Wesco reports no disruption or evidence of ransomware or malware, and says it does not believe sensitive data is at risk.
Key points
- Wesco says it is investigating an incident involving its cloud CRM environment after ExfilSquad claimed CRM data was exfiltrated.
- ExfilSquad claimed to have stolen 2.6 million records containing personal, account, contact, and authentication-related data, and later published data allegedly taken from Wesco.
- Wesco says it detected the issue quickly and found no evidence of ransomware or other malicious software.
- Wesco reports no business disruption and says it does not believe sensitive customer, employee, or financial data is at risk.
- Researchers examining ExfilSquad activity say the actor previously targeted improperly configured Microsoft Power Pages data tables; Wesco has not disclosed how the incident occurred.
Article Details
- Victim Organization
- Wesco
- Incident Type
- Cybersecurity incident involving Wesco's cloud CRM environment; ExfilSquad claimed data exfiltration and publication.
- Data Types Exposed
- Customer and employee personally identifiable information (claimed)
- Account and contact data (claimed)
- CRM user profiles (claimed)
- Credit and business identifiers (claimed)
- Authentication metadata and access information (claimed)
- Affected Records
- ExfilSquad claimed to have targeted 2.6 million records.
- Operational Impact
- Wesco said there was no business disruption and operations continued normally. The company reported no evidence of ransomware or other malicious software and said it did not believe sensitive customer, employee, or financial data was at risk.
- Ransom Or Extortion
- ExfilSquad reportedly set a deadline for Wesco to enter ransom payment negotiations. After the deadline expired, it published data it claimed to have exfiltrated. No ransom payment was reported.
- Claim Status
- claimed
People
Threat Actors
Vendors
Products
Microsoft Dynamics 365ExfilSquad allegedly targeted 2.6 million records, and researchers linked its activity to Microsoft Power Pages and possibly Microsoft Dynamics 365.Microsoft Power PagesExfilSquad allegedly targeted 2.6 million records, and researchers linked its activity to Microsoft Power Pages and possibly Microsoft Dynamics 365.