On July 26, 2026, a previously unknown ransomware and data extortion group calling itself ExfilSquad surfaced on the dark web and immediately made one of the boldest opening moves seen from a new threat actor in recent memory: fourteen simultaneous breach claims against organizations across five countries, published in a single coordinated post. The most prominent name on that list was Microsoft Corporation.

The claim: 130 gigabytes of uncompressed data exfiltrated from Microsoft’s environment, containing approximately 8 million records. As of this writing, Microsoft has not issued any public statement, no verifiable sample data has been released by the group, and independent researchers have not confirmed the breach. What follows is a structured breakdown of everything that is confirmed, what is disputed, and what the claim means for organizations that run Microsoft cloud infrastructure.

Who Is ExfilSquad

ExfilSquad has no prior history. The group’s dark web leak site went live on July 26, 2026, and the Microsoft claim was among its first published posts. This is unusual. Most established ransomware groups build credibility by posting smaller, verifiable victims first before targeting household names. ExfilSquad skipped that step entirely and went straight to claiming Microsoft, Allstate, Frontier Airlines, Zenith Bank, and government entities in the same initial post.

Security researchers tracking the group through dark web monitoring platforms have flagged several characteristics. The group does not appear affiliated with any known ransomware-as-a-service (RaaS) operation. There is no evidence of a negotiation portal, no Bitcoin payment address published, and no ransom demand figure disclosed publicly. This pattern, claiming data without demanding ransom, is more consistent with a pure extortion or reputational damage campaign than a traditional ransomware operation.

SOCRadar’s dark web profile for ExfilSquad notes the group has a preference for high-value sectors: technology, government, financial services, and critical infrastructure. The 14 initial victims span the United States, the United Kingdom, Sweden, and Nigeria, covering both private sector corporations and public sector agencies.

The Microsoft Breach Claim: What Was Alleged

The group’s posting on their dark web site describes the alleged Microsoft dataset as containing approximately 8 million records across multiple data categories. Their stated claim, reproduced here for research purposes, lists the following data types:

  • Personally identifiable information (PII) covering employee and customer records
  • Authentication data, specifically described as including password hashes
  • Portal and account identities
  • Corporate account information and business leads
  • Facilities management records
  • Internal service ticket data
  • Access permission configurations

The group claims the raw dataset is 130GB in uncompressed form. No file listing, directory structure, sample rows, or schema dump has been shared to substantiate this. The listing on their site carries no deadline, no countdown timer, and no stated price. Darkfield/Orizon’s breach tracking entry for this incident classifies it as “critical” based on the alleged data scope, while simultaneously flagging the absence of evidence as a significant credibility concern.

The Full List of 14 Simultaneous Victim Claims

Understanding the full scope of ExfilSquad’s initial posting matters for credibility assessment. Groups that genuinely breach organizations at scale tend to release victims in waves, using each confirmed victim as leverage for the next. Releasing 14 simultaneously, without evidence for any of them, is a different pattern entirely.

The organizations listed in ExfilSquad’s initial post include:

  • Technology: Microsoft Corporation, Analog Devices, Viavi Solutions
  • Insurance and Financial: Allstate Insurance, Zenith Bank Plc (Nigeria)
  • Airlines and Transportation: Frontier Airlines, Wesco International
  • Real Estate: Bonava (Sweden)
  • Sporting Goods: TaylorMade and Sun Day Red Golf
  • US Government/Municipal: City of Houston, City of Atlanta, District of Columbia Public Schools
  • UK Government/Education: UK Department for Education, Police National Legal Database (UK), Newcastle University

Several of these organizations have not responded publicly. None of the listed victims have confirmed a breach as of this writing. The UK Police National Legal Database and the Department for Education are particularly sensitive targets, and their inclusion without any corroborating evidence is notable either as a sign of genuine access or a calculated reputational attack.

Credibility Assessment: What the Evidence Actually Says

The honest assessment here is that ExfilSquad’s Microsoft claim is unverified and contains significant red flags. That does not mean the breach did not happen. It means the claim cannot be confirmed based on available evidence.

The factors that reduce credibility:

  • No data samples released for any of the 14 victims
  • No file tree or directory listing showing the structure of the alleged 130GB
  • No ransom demand or negotiation process (unusual for a group claiming this scale)
  • The group is brand new with no track record to assess
  • The pattern of 14 simultaneous claims with zero evidence matches historical behavior of attention-seeking actors rather than serious extortion operations

The factors that keep this from being dismissible:

  • The data types described (service tickets, access permissions, portal identities, password hashes) are highly specific and operationally useful. Fabricated claims tend to be vague. This specificity either indicates genuine access or a very well-researched fabrication.
  • July 2026 saw a cluster of critical Microsoft API and SharePoint vulnerabilities actively exploited in the wild. CVE-2026-56164 (unauthenticated SharePoint EoP) and CVE-2026-55040 (SharePoint JWT bypass) both created paths for API-level access to Microsoft environments. The timing of the ExfilSquad emergence, two weeks after these patches, is worth noting.
  • Microsoft’s silence does not confirm the breach, but large companies with nothing to disclose typically issue a brief denial quickly. Extended silence, while legally cautious, is unusual if the claim is entirely baseless.

The most accurate characterization right now: unverified, not yet refuted, actively being investigated by third-party researchers.

How This Connects to the July 2026 Microsoft Vulnerability Cluster

For readers who followed the July 2026 Patch Tuesday cycle, the timing here is not coincidental. That patch cycle addressed 622 CVEs including two actively exploited zero-days, with SharePoint bearing the heaviest cluster of critical issues.

CVE-2026-56164 (unauthenticated SharePoint Server elevation of privilege, CISA KEV-listed) and CVE-2026-55040 (SharePoint JWT authentication bypass, patch delayed to August) together create a path to unauthenticated API access on unpatched SharePoint deployments. If an attacker exploited these before the July 14 patch, they would have had two weeks of access to SharePoint REST API endpoints, Microsoft Graph API connections routed through SharePoint, and internal content accessible via that API surface.

The data types ExfilSquad claims, specifically service tickets, access permissions, and portal identities, are exactly what would be accessible through a SharePoint-adjacent API compromise. This is hypothesis, not confirmed attack chain. But it is the most technically coherent explanation available given the timing.

What SOC Teams Should Check Immediately

Regardless of whether ExfilSquad’s Microsoft claim is verified, the July 2026 period has been exceptionally active for Microsoft environment targeting. The following detection queries focus on signs of API-level data exfiltration and unusual Microsoft cloud activity that would be relevant to both this specific claim and the broader threat landscape.

Microsoft Sentinel KQL: Bulk Data Access via Microsoft Graph API

// Detect service principals pulling unusually large volumes of data via Graph API
AuditLogs
| where TimeGenerated > ago(14d)
| where Category == "ApplicationManagement"
| where OperationName has_any ("List", "Get", "Export", "Download")
| where Result == "success"
| summarize OperationCount = count() by
    InitiatedByApp = tostring(InitiatedBy.app.displayName),
    OperationName,
    bin(TimeGenerated, 1h)
| where OperationCount > 500
| order by OperationCount desc
// Detect unusual sign-ins followed by high-volume SharePoint API access
let SuspiciousSignIns = SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == 0
| where IPAddress !startswith "10." and IPAddress !startswith "192.168."
| where RiskLevelDuringSignIn in ("high","medium")
| project SignInTime = TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName;
let SharePointAccess = OfficeActivity
| where TimeGenerated > ago(14d)
| where RecordType == "SharePointFileOperation"
| where Operation has_any ("FileDownloaded","FileAccessed","SearchQueryPerformed")
| summarize FileOps = count() by UserId, bin(TimeGenerated, 1h);
SuspiciousSignIns
| join kind=inner SharePointAccess on $left.UserPrincipalName == $right.UserId
| where FileOps > 200
| project SignInTime, UserPrincipalName, IPAddress, AppDisplayName, FileOps
// Hunt for OAuth app consent grants to new applications in past 14 days
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Consent to application","Add app role assignment to service principal")
| extend AppName = tostring(TargetResources[0].displayName)
| extend GrantedBy = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, AppName, GrantedBy, Result, AdditionalDetails
| order by TimeGenerated desc

Microsoft Sentinel KQL: SharePoint API Exfiltration Indicators

// Large volume file access from a single IP within a short window (bulk scrape pattern)
OfficeActivity
| where TimeGenerated > ago(14d)
| where RecordType == "SharePointFileOperation"
| where Operation == "FileDownloaded"
| summarize FilesDownloaded = count(), UniqueFiles = dcount(ObjectId)
    by ClientIP, UserId, bin(TimeGenerated, 30m)
| where FilesDownloaded > 100
| order by FilesDownloaded desc
// Detect service principal token used from new geographic location
SigninLogs
| where TimeGenerated > ago(14d)
| where AppId != "" and UserType == "Member"
| where LocationDetails.countryOrRegion !in ("India","United States")
| where AppDisplayName has_any ("Microsoft Graph","SharePoint","Exchange")
| project TimeGenerated, UserPrincipalName, AppDisplayName,
          IPAddress, LocationDetails, RiskLevelDuringSignIn
| order by TimeGenerated desc

Splunk SPL: Graph API and Exchange Bulk Access

index=o365 Workload=AzureActiveDirectory Operation IN ("UserLoggedIn","UserLoginFailed")
ResultStatus="Success" ClientIP!="10.*" ClientIP!="192.168.*"
| stats count AS LoginCount by UserId, ClientIP, bin(_time, 1h)
| where LoginCount > 20
| join UserId [
    search index=o365 Workload=SharePoint Operation=FileDownloaded
    | stats count AS Downloads by UserId, bin(_time, 1h)
    | where Downloads > 100
]
| table _time, UserId, ClientIP, LoginCount, Downloads
| eval alert="High login + bulk download - API exfiltration pattern"
index=o365 Workload=MicrosoftGraphActivityLogs
Operation IN ("GET","POST") uri="*/users/*/messages*" OR uri="*/drives/*/items*"
| stats count AS APIRequests, dc(uri) AS UniqueEndpoints by app_id, ip, bin(_time, 1h)
| where APIRequests > 1000
| eval alert="High volume Graph API enumeration"
| table _time, app_id, ip, APIRequests, UniqueEndpoints, alert

Immediate Actions for Microsoft Enterprise Customers

Whether or not ExfilSquad’s claim against Microsoft proves genuine, the July 2026 threat environment warrants specific protective actions for any organization running Microsoft 365, Azure, or SharePoint Server.

Audit service principal permissions this week. Run an inventory of all OAuth applications and service principals that have Graph API permissions, particularly User.Read.All, Files.Read.All, Sites.FullControl.All, and Mail.Read. Any application with these permissions that was not explicitly provisioned by your team should be investigated.

Review SharePoint audit logs for the period June 25 to July 14, 2026. That window covers the period between likely zero-day exploitation and patching. Look specifically for bulk file downloads, API enumeration activity, and Search query operations from unusual IP addresses or service accounts.

Rotate credentials for any service principal that touched SharePoint or Exchange Online during that window. If you cannot confirm what a service principal was doing during the vulnerability window, treat the credential as potentially compromised.

Check your Azure AD application consent grants. Attackers who gain short-term access to a privileged user account sometimes create new OAuth application registrations with delegated permissions. These persist after the session expires and provide ongoing API access even after the original access is revoked.

For broader context on how nation-state threat actors exploit Microsoft API surfaces during vulnerability windows, the Volt Typhoon LOTL detection analysis on this site covers the living-off-the-land techniques that make API-based access so hard to detect. The same detection principles apply to criminal extortion groups that adopt similar tradecraft.

This situation is developing. When Microsoft issues a formal statement or independent researchers verify or refute the data, this post will be updated with confirmed findings.

External references: Cypro: ExfilSquad Ransomware Claims Microsoft Breach | DeXpose: ExfilSquad Targets Microsoft | BreachSense: Microsoft Data Breach 2026 | Heise: Young cyber gang claims data theft from Microsoft