Wesco Investigates Data Breach After ExfilSquad Claims Theft of 2.6 Million Records
On August 11, 2026, global supply chain and distribution company Wesco confirmed it is investigating a cybersecurity incident following claims by the data extortion group ExfilSquad that it stole and leaked 2.6 million records from the company’s cloud CRM environment. Wesco stated that no business disruption occurred, no ransomware or malware was detected on internal systems, and sensitive customer or employee data including payment card or financial account information was not believed to be at risk. However, ExfilSquad’s leak allegedly includes personally identifiable information (PII), account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access-related details, raising concerns about downstream phishing, business email compromise (BEC), and fraud risks for Wesco’s partners and customers.
The attack appears to have targeted Wesco’s cloud CRM system, likely based on Microsoft Dynamics 365, with potential exploitation of misconfigured Microsoft Power Pages data tables. ExfilSquad, known for extortion-only operations, typically gains initial access via compromised credentials or exposed cloud applications, then uses legitimate tools like 7z, rclone, and PowerShell to stage and exfiltrate data to attacker-controlled cloud storage (e.g., MEGA, pCloud). The group’s tactics align with the MITRE ATT&CK framework, including valid account abuse (T1078), cloud service discovery (T1526), and exfiltration over web services (T1567.002). No malware was detected, and all activities leveraged dual-use administrative tools, complicating detection.
ExfilSquad has a history of targeting supply chain, education, and public sector organizations, with prior breaches at Analog Devices, the UK’s Police National Legal Database, and Newcastle University. The stolen data reportedly containing customer lists, shipment details, and project pricing poses significant third-party risk, as it can be weaponized for spear phishing and invoice fraud across Wesco’s ecosystem.
Key Timeline:
- August 7, 2026: ExfilSquad begins distributing stolen data via torrents.
- August 11, 2026: Wesco confirms the incident after ExfilSquad publishes the leaked data following failed ransom negotiations.
As of the report date, no technical indicators of compromise (IOCs) beyond a single domain (mallory[.]ai) have been publicly disclosed, and no regulatory filings or law enforcement advisories have been referenced. The incident underscores the growing threat of data theft extortion targeting cloud environments, particularly in sectors handling sensitive partner data.
Wesco TPRM report: https://www.rankiteo.com/company/wesco
"id": "wes1786569977",
"linkid": "wesco",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Supply Chain and Distribution',
'location': 'Global',
'name': 'Wesco',
'type': 'Company'}],
'attack_vector': ['Compromised credentials', 'Exposed cloud applications'],
'data_breach': {'data_exfiltration': True,
'number_of_records_exposed': '2.6 million',
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personally identifiable '
'information (PII)',
'Account and contact data',
'CRM user profiles',
'Credit and business identifiers',
'Authentication metadata',
'Access-related details']},
'date_detected': '2026-08-11',
'date_publicly_disclosed': '2026-08-11',
'description': 'On August 11, 2026, global supply chain and distribution '
'company Wesco confirmed it is investigating a cybersecurity '
'incident following claims by the data extortion group '
'ExfilSquad that it stole and leaked 2.6 million records from '
'the company’s cloud CRM environment. The attack targeted '
'Wesco’s cloud CRM system, likely based on Microsoft Dynamics '
'365, with potential exploitation of misconfigured Microsoft '
'Power Pages data tables. The stolen data includes personally '
'identifiable information (PII), account and contact data, CRM '
'user profiles, credit and business identifiers, '
'authentication metadata, and access-related details, raising '
'concerns about downstream phishing, business email compromise '
'(BEC), and fraud risks.',
'impact': {'data_compromised': '2.6 million records',
'identity_theft_risk': 'High (PII exposed)',
'operational_impact': 'No business disruption',
'payment_information_risk': 'None (payment card or financial '
'account information not believed to '
'be at risk)',
'systems_affected': 'Cloud CRM system (Microsoft Dynamics 365)'},
'initial_access_broker': {'entry_point': ['Compromised credentials',
'Exposed cloud applications']},
'investigation_status': 'Ongoing',
'motivation': 'Extortion',
'post_incident_analysis': {'root_causes': ['Misconfigured Microsoft Power '
'Pages data tables',
'Abuse of valid accounts (T1078)',
'Cloud service discovery (T1526)']},
'ransomware': {'data_exfiltration': True},
'references': [{'source': 'ExfilSquad data leak'}],
'response': {'communication_strategy': 'Public disclosure of incident'},
'threat_actor': 'ExfilSquad',
'title': 'Wesco Investigates Data Breach After ExfilSquad Claims Theft of 2.6 '
'Million Records',
'type': 'Data Breach',
'vulnerability_exploited': 'Misconfigured Microsoft Power Pages data tables'}