The UK’s Police National Legal Database (PNLD) — the legal reference system used by all 43 Home Office police forces in England and Wales plus the British Transport Police — has confirmed a data breach affecting roughly 135,000 records of police officers, staff, and criminal justice professionals. The attack is one of at least 15 claimed by a newly surfaced data-extortion group calling itself ExfilSquad, and unlike most breaches making headlines this year, it didn’t involve an exploit, malware, or credential theft at all — it involved a public web portal configured to hand its backend database to anyone who asked.

What happened

PNLD detected the intrusion on July 26 and confirmed that names, organizations, and work email addresses tied to roughly 114,000 PNLD subscribers and 21,000 users of the associated “Ask the Police” service had been accessed. The database itself does not store information about victims, witnesses, or offenders, and PNLD says there is no evidence login credentials were taken — but the exposed contact list is precisely the kind of data set that fuels targeted phishing against police and justice personnel.

ExfilSquad, first observed publicly on July 26, has claimed 15 victim organizations on its leak site, publishing a sample of the PNLD data and demanding payment to withhold the rest. Researchers at VenariX examined data samples tied to 11 of the group’s 15 claimed victims and found the underlying record structures consistent with Microsoft Dataverse exports across all of them — the strongest signal yet that this is a single technique being run at scale rather than 15 unrelated incidents.

Technical details

  • Vector: misconfigured Microsoft Power Pages portals (formerly Power Apps portals) with the built-in Anonymous Users role granted read access to backend Dataverse tables
  • Mechanism: Power Pages exposes a /_api Web API (and in older deployments a legacy OData feed) that performs CRUD operations against Dataverse directly; if table permissions grant the Anonymous Users role access, that data becomes retrievable by anyone who requests the endpoint — no authentication, no exploit code, no CVE
  • Confirmation: in at least one of the 15 claimed cases (a Houston-area organization), researchers directly reproduced the issue — the public portal returned full records with zero authentication, matching the data ExfilSquad had already published
  • No lateral movement: consistent with the technique, PNLD and the other identified victims show no evidence of ransomware, malware deployment, or movement beyond the exposed table data itself — this is data scraping via broken access control, not intrusion in the traditional sense
  • Scale signal: 15 claimed victims from one actor working one misconfiguration class in under two weeks indicates either a scanning tool built specifically for anonymous-access Power Pages/Dataverse instances, or a shared list of misconfigured tenants being worked systematically

Impact

This is a supply-chain-adjacent problem in the sense that matters most for defenders: the vulnerability isn’t in Power Pages the product, it’s in how organizations configure entity permissions on top of it, and Microsoft’s own documentation is explicit that granting Anonymous Users access to a table makes it world-readable. That means every organization running a public-facing Power Pages site is a candidate victim until someone audits table permissions — and low-code/no-code platforms like Power Pages are increasingly stood up by business units without security review, widening the population of misconfigured instances. For PNLD specifically, the exposed contact data creates a durable phishing and social-engineering target list against police and justice personnel — a second-order risk that persists long after the initial leak.

Mitigation

  • Audit every Power Pages / Power Apps portal table for Anonymous Users role permissions. If a table doesn’t need to be publicly readable, the Anonymous Users role should not have access to it — this is the single control that stops the entire technique.
  • Review the /_api Web API and any legacy OData feed configuration on public-facing portals; disable them where the portal doesn’t require programmatic data access from unauthenticated visitors.
  • Treat Power Pages deployments as internet-facing assets requiring the same access-control review as any public API, not as low-risk internal tooling — the “low-code” framing has led many teams to skip the review a traditional web app would get.
  • Organizations that received PNLD contact data should treat it as a phishing enablement event: expect targeted spear-phishing against listed police and justice personnel using this contact list, and brief staff accordingly.
  • If you run a Power Pages portal, check Microsoft’s table permissions guidance directly and consider a one-time export-and-review of all tables currently granted to the Anonymous Users role — VenariX’s methodology (requesting the /_api endpoint unauthenticated) is a fast way to self-test exposure.

Sources: The Hacker News — PNLD Breach Exposes U.K. Police and Government Contact Details on Dark Web, The Register — Police National Legal Database confirms data theft after dark web leak, BleepingComputer — ExfilSquad hackers leak info of over 100,000 UK police officers, staff, VenariX — ExfilSquad Targets Misconfigured Microsoft Power Pages Portals, Security Affairs — PNLD Confirms Data Breach Affecting UK Police and Justice Staff.