The data extortion group ExfilSquad claimed to have stolen 2.6 million records from Wesco, including customer and employee PII, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information. Wesco confirmed the incident involves its cloud CRM environment and is working with its cloud CRM vendor. The company reports no business disruption and no evidence of ransomware or other malware. Wesco does not believe sensitive payment card, financial, or other sensitive data is at risk. ExfilSquad has a history of exploiting improperly configured Microsoft Power Pages data tables, which may be relevant given Wesco's use of Microsoft Dynamics 365. The threat actor published the data after the ransom deadline expired. Wesco has not disclosed the breach vector or further technical details.

Potential exposure of 2.6 million records containing personal identifiable information (PII) of customers and employees, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata, and access information. Wesco states no evidence of ransomware or malware infection and no risk to payment card or financial account information. The incident may impact Wesco's data confidentiality and could have reputational consequences. No reported operational disruption or business impact so far.

Wesco has engaged with its cloud CRM vendor and is investigating the incident. The company detected the breach quickly and reports no evidence of ransomware or malware. No official patch or remediation guidance is provided. Organizations using similar cloud CRM environments should verify their configurations, especially for Microsoft Power Pages data tables, to prevent misconfigurations. Monitor vendor advisories for updates. No urgent action is indicated by Wesco at this time.