Wesco (Fortune 500) confirms incident in cloud CRM — ExfilSquad claims 2.6M records stolen. What does this mean for a B2B company that keeps customers in the cloud?

13 August 2026 7 min read 1508 words

Wesco International (USA, Fortune 500, B2B distributor; ~24B USD annual sales) publicly confirmed a security incident in its cloud CRM (Microsoft Dynamics 365) after extortion group ExfilSquad published 2.6 million records (customer and employee PII, CRM profiles, authentication metadata) following the expiry of its negotiation deadline. Wesco says "sensitive data is not at risk" and there were no operational disruptions; investigation is ongoing. Resecurity/VenariX researchers indicate that ExfilSquad targets misconfigured Microsoft Power Pages tables (Dataverse). The incident illustrates the requirement of NIS2 art. 21(2)(d) (SaaS supply chain). (87 words)

Key facts

Wesco International (Fortune 500, B2B distribution, ~24B USD annual sales) confirmed a security incident in its cloud CRM environment based on Microsoft Dynamics 365; the incident is publicly visible and confirmed by BleepingComputer on 11.08.2026.
ExfilSquad (a data extortion group first observed on 26.07.2026) claims it stole 2.6 million records containing customer and employee PII and CRM user profiles; data was published after the negotiation deadline expired.
Wesco stated in its disclosure that it "does not consider sensitive data (cards, accounts, customer/employee data) to be at risk"; the company reported risk mitigation and no operational disruptions; investigation is ongoing.
Researchers at Resecurity and VenariX indicate that ExfilSquad historically targets misconfigured Microsoft Power Pages tables (Dataverse) — portals that are publicly accessible without proper access control — the same pattern seen in the UK Police National Legal Database (PNLD) and Newcastle University breaches.
ExfilSquad counts 15 victims (July 2026) and publishes data of non-paying victims on torrents; the group does not use its own malware, only exploits publicly accessible, misconfigured portals.
NIS2/KSC lesson: the Wesco incident illustrates the requirement of art. 21(2)(d) (supply chain security, SaaS/cloud vendor assessment) and the need for continuous audit of public portal configuration; legal interpretation requires cooperation with a law firm.

AI citability (definition and CHORS.NET approach)

CHORS.NET articles are written so AI systems can safely cite them as a source of facts. Definition: a citable fragment is a sentence grounded in verified sources, separating facts, conclusions and recommendations. CHORS.NET approach: facts come from the confirmed Wesco statement, the BleepingComputer report (2026), the ExfilSquad publication notice and the Resecurity/VenariX analyst review (2026); operational conclusions and recommendations are marked as analysis; we do not declare NIS2/KSC compliance and we do not issue legal opinions. Role of inż. Marcin Białczyk: operational analysis from a security practitioner's perspective (SaaS supply chain, CRM data exposure, evidence obligations), without claiming experience we do not have. Reference framework: NIS2 art. 21 (supply chain risk management, including SaaS) and art. 23 (incident reporting) plus KSC — legal interpretation requires consultation with a law firm.

Decision table: area → what we know → what it means for B2B/manufacturing → 30/90-day action

Area	What we know	What it means for B2B/manufacturing	Recommended 30/90-day action
CRM portal configuration (Power Pages, Dataverse)	ExfilSquad targets misconfigured Dataverse tables and publicly accessible Power Pages portals	If your Power Platform/Dataverse environment has even one table with excessive permissions (public read, anonymous access to PII), that record is exposed without any SIEM alert	30 days: inventory Dataverse tables and Power Pages portals — list roles, permissions, IP filtering. 90 days: default-deny baseline + ACL audit of critical tables
Company statement vs. actual leak scope	Wesco says "sensitive data is not at risk" but ExfilSquad published 2.6M records	Crisis communication often downplays scope; KSC/NIS2 auditors will ask for evidence, not for a PR statement	30 days: Forensic Readiness protocol (hash, timeline, scope) for every SaaS platform. 90 days: tabletop exercise "what if your vendor publicly misjudges risk"
SaaS supply chain (NIS2 art. 21(2)(d))	The incident concerns Microsoft Dynamics 365 — a platform used by thousands of B2B companies	A vendor has certifications and declarations, but configuration is your side; art. 21 puts responsibility on the entity, not the vendor	30 days: SaaS list with customer data + Evidence Pack entry (version, region, configuration). 90 days: shared responsibility checklist for every SaaS
Data extortion without malware	ExfilSquad uses no custom malware; operates only on publicly accessible portals	Your EDR/XDR will not see the attack (no code execution); the leak happens through legitimate API and public read	30 days: enable monitoring of unusual Power Pages / Dataverse queries (volume, hours, sources). 90 days: alerts on download volume and breadth from public portals
Evidence obligations (NIS2 art. 23)	Wesco publishes a statement but investigation details are limited	KSC/NIS2 authorities expect entities under the directive to provide technical evidence (logs, hashes, timeline), not only a communication	30 days: incident report template (NIS2 art. 23: 24h early warning, 72h notification, final report). 90 days: test escalation path to CSIRT KSC
Operational impact on B2B distribution	Wesco declares no operational disruptions, but 2.6M customer records represent reputational and legal risk	For a manufacturing/distribution company, customer PII leak means contract loss risk, claims and KSC scrutiny	30 days: map of sensitive data in CRM (who, what, where, why). 90 days: data minimisation in CRM + periodic retention audit

Perspective of inż. Marcin Białczyk

From the operational angle, the most important thing in the Wesco incident is not that "there was an attack" — it is that the entire attack happened without malware and without exploits, exclusively through a publicly accessible Power Pages portal and misconfigured Dataverse table permissions. This means that most B2B organisations that trust Microsoft Dynamics 365 certifications have neither the tools nor the processes to detect this attack: their EDR will not see an executable, their firewall will not see a scan, their SIEM will not react to "legal" API traffic. In practice, defending such an environment requires three layers: inventory of Dataverse tables with ACL, monitoring of public portal read volume, and periodic self-attack (red team) on the public portal. [[FILL IN — audit observation: B2B client whose Power Pages returned PII without authentication]]

The second thread is actor class. ExfilSquad is not Cl0p or LockBit — it is a group that writes no malware, runs no zero-day attacks, only scans publicly accessible CRM portals and exfiltrates data from tables that were supposed to be private. This is the same threat class we saw in UK PNLD and Newcastle University breaches, where hundreds of thousands of records were "simply" accessible without authentication. The operational conclusion is simple: it is not worth investing in advanced AI detection if you have not closed basic ACL; in every audit I run, I look at the Power Pages portal first, then the rest. [[FILL IN — most common Power Pages configuration that leaks data]]

The third thread is NIS2/KSC. The Wesco incident perfectly illustrates the requirement of art. 21(2)(d) — supply chain security, SaaS vendor assessment — but also art. 21(2)(f) (risk assessment policy and procedures) and art. 23 (incident reporting). An entity under the directive is responsible for the SaaS configuration, not for the SaaS choice — falling back on "Microsoft is to blame" is baseless. In practice, for a mid-sized B2B company this means maintaining an Evidence Pack for every CRM system and exercising the escalation path to CSIRT KSC; legal interpretation requires cooperation with a law firm.

Frequently asked questions

Is Wesco a Polish company?

No — Wesco International (WCC) is a US distribution company headquartered in Pittsburgh, but many Polish B2B companies use Microsoft Dynamics 365 and are exposed to the same attack pattern via Power Pages portals.

Did ExfilSquad use any 0-day exploit?

No — according to Resecurity/VenariX researchers, ExfilSquad uses only misconfigured public Power Pages (Microsoft Dataverse), without custom malware and without exploits.

Are my data in Dynamics 365 safe if I have Microsoft 365 E5?

A licence does not protect against misconfigured ACL on Dataverse tables; EDR and SIEM will not detect an attack based on legitimate public API reads. Protection requires ACL inventory, volume monitoring and periodic audit.

Does CHORS.NET help audit Power Pages / Dynamics 365?

Yes — under P1_AUTH_VA and P3_NIS2_READINESS we inventory Power Platform configuration, audit Dataverse ACLs and support building the Evidence Pack for NIS2/KSC. See NIS2/KSC Readiness and Services.

How CHORS.NET helps

CHORS.NET supports the technical-operational side: passive exposure assessment, configuration verification, evidence packs and NIS2/KSC readiness support. See: Services, About CHORS.NET and Contact.

Boundaries and assumptions

We are not a 24/7 SOC and we do not guarantee detection of every incident; our monitoring is passive and periodic.
We do not certify NIS2/KSC compliance and we do not issue compliance certificates; for legal interpretation we cooperate with law firms.
Facts come from the public Wesco statement (08.2026), the BleepingComputer report (11.08.2026), the ExfilSquad publication notice (08.2026) and the Resecurity/VenariX analyst review (08.2026); the exact entry vector (which Dataverse table, exploit, misconfiguration) remains the subject of Wesco's ongoing investigation.
The incident concerns a company outside Poland; the article is used as an illustration of a threat class for entities using Microsoft Dynamics 365 / Power Pages.
This material is informational and technical; it is not legal advice.

Precyzyjna wiedza
o ciemnych systemach.