Misconfiguration Exploitation: FINRA Warns Firms of Data Extortion via Power Pages

FINRA warned member firms that use Microsoft Dynamics 365 or Microsoft Power Pages of an ongoing data extortion campaign by a group exploiting misconfigured portals to access sensitive customer and employee information, and threatening to publish the stolen data unless a ransom is paid.

In the Cybersecurity Alert, FINRA stated that a group known as ExfilSquad is exploiting misconfigured Dataverse table permissions that grant overly broad read access to anonymous users. This misconfiguration allows unauthenticated visitors to query and extract personally identifiable information directly from exposed tables through the Power Pages web API. FINRA noted that the campaign involves data exfiltration and extortion rather than a software vulnerability or network-level ransomware.

To mitigate the risk, FINRA recommended a variety of measures. Additionally, FINRA advised firms to review their vendor risk management programs to ensure they can respond to third-party security incidents (see prior coverage).

FINRA stated that the alert does not create new legal or regulatory requirements or relieve firms of existing obligations.