NewsPublished 11 Aug 2026

Wesco confirms security incident after ExfilSquad claims data theft

Source Bleeping Computer

supply-chain

Description

Wesco, a global supply chain and distribution company, confirmed a cybersecurity incident involving its cloud CRM environment after the data extortion group ExfilSquad claimed to have stolen and leaked sensitive data. Wesco states the incident was detected quickly, with no evidence of ransomware or malicious software, and believes no sensitive customer or employee data is at risk. The threat actor published allegedly exfiltrated data after ransom negotiations failed. The exact breach method is not disclosed, but ExfilSquad has previously targeted misconfigured Microsoft Power Pages data tables. Wesco continues normal operations and is investigating the incident.

Impact

Potential exposure of 2.6 million records containing personal identifiable information (PII) of customers and employees, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information. Wesco states no evidence of ransomware or malware infection and no risk to payment card or financial account information. The incident may impact Wesco's data confidentiality and could have reputational consequences. No reported operational disruption or business impact so far.

Defensive guidance

Wesco has engaged with its cloud CRM vendor and is investigating the incident. The company detected the breach quickly and reports no evidence of ransomware or malware. Organizations using similar cloud CRM environments should verify their configurations, especially for Microsoft Power Pages data tables, to prevent misconfigurations. Monitor vendor advisories for updates. No urgent action is indicated by Wesco at this time.

Summary

The data extortion group ExfilSquad claimed to have stolen 2.6 million records from Wesco, including customer and employee PII, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information. Wesco confirmed the incident involves its cloud CRM environment and is working with its cloud CRM vendor. The company reports no business disruption and no evidence of ransomware or other malware. Wesco does not believe sensitive payment card, financial, or other sensitive data is at risk. ExfilSquad has a history of exploiting improperly configured Microsoft Power Pages data tables, which may be relevant given Wesco's use of Microsoft Dynamics 365. The threat actor published the data after the ransom deadline expired. Wesco has not disclosed the breach vector or further technical details.

References

bleepingcomputer.com/news/security/wesco-confirms-security-incident-after-exfilsquad-claims-data-theft/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Aug 2026, 16:11 UTC

References

Community reviews

Related threats