decrypted · 4 august 2026 · ransomware and cybercrime · supply chain · ai and llm security

The police database ExfilSquad walked into, and the low-code habit behind it

ExfilSquad, a hacking group nobody had heard of before last week, spent late July working through a list of UK public sector targets and quietly pulling data out of each one. This week the latest confirmed victim, the Police National Legal Database (PNLD), told the world what had happened: contact details for more than 100,000 serving police officers, criminal justice staff and members of the public who had used its "Ask the Police" service, sitting on a dark web leak site. The Department for Education breach Decrypted covered on 31 July was the first of this group's victims to surface. PNLD is not the last, and what has changed this week is that researchers now have a working theory for what links all fifteen.

A shared front door, not fifteen separate break-ins

PNLD confirmed on 3 August that ExfilSquad had taken names, employing organisations and work email addresses, and said there is no evidence that passwords or other credentials were compromised, and that its database holds no confidential victim, witness or offender information. Small mercies. The more interesting finding came from VenariX, a threat-intelligence firm that reviewed leaked samples from eleven of ExfilSquad's fifteen claimed victims and found the same underlying pattern in each: data structures consistent with Microsoft's Power Pages, a low-code tool for building public-facing web forms on top of Microsoft's Dataverse database. PNLD has not confirmed this as the specific route into its own systems, but the pattern across the other targets is hard to ignore.

Think of Power Pages as a shopfront a council or agency can build without much developer effort: a form for the public to submit a query, backed by a database that a properly configured system would lock down table by table. The trouble is those tables are not private by default. Left on permissive settings, a public "Ask the Police" form can double as an open door into a database that also holds internal staff records. No password needed, because nobody had to log in to begin with.

The Secure by Design lesson

This is not a story about fifteen careless IT teams. It is a story about a platform where the safe configuration takes real expertise to find and the unsafe one is the path of least resistance. Secure by Design, as the NCSC defines it, means vendors ship products where the default is the safe choice, not a setting buried in an admin panel that only a specialist would think to check. Low-code platforms exist precisely so non-developers can build public services quickly, and that is a reasonable trade, but only if quick and correctly scoped are the same setting, not two separate things a busy comms team has to get right on their own.

For UK organisations, the useful step this week is not just "audit your Power Pages sites", though that is worth doing if you run any. It is to ask who owns default configuration in every low-code and no-code tool now embedded in public service delivery, and whether that owner has ever actually been asked to check it.

Also this week

An RMM flaw with a blast radius measured in customers, not servers. N-able first noticed unusual activity on its N-central platform on 31 July, disclosed active exploitation of an authentication bypass on 1 August, and shipped hotfix 2026.3.1.7 on 2 August. CVE-2026-18577 let attackers take over admin accounts and abuse N-central's "Take Control" feature to reach the endpoints it manages, then persist using Cloudflare tunnels. It has since been added to CISA's Known Exploited Vulnerabilities catalogue. N-central is a remote monitoring and management tool used by managed service providers to administer client networks, so one flaw here compromises not just N-able's customers but everyone those customers manage on behalf of others. Huntress reported that more than half of partner cloud servers it could see remained unpatched as the week began. Any UK organisation that outsources IT to an MSP should be asking this week whether that MSP has patched, and whether it monitors its own management console for compromise, not just yours.

A Word document that infects the next one. Researcher Håkon Måløy closed out a disclosure process with Microsoft that began on 6 March, after repeatedly showing that Copilot for Word can be turned into a self-propagating prompt injection. Hidden white-on-white text in a document instructs Copilot to alter content and copy the same hidden instruction into whatever the user produces next, so a colleague's later Copilot session inherits it. Microsoft has patched each variant Måløy has reported, including a model upgrade in mid-July, and he has found a way through each time, because the underlying problem is architectural: a model has to read untrusted content before it can judge whether that content is safe to act on. Organisations rolling out Copilot or similar tools should treat any document from outside a tightly controlled source as untrusted input to the model, not just untrusted input to the reader.

Sources

If you want to talk through what Secure by Design means for your organisation's own systems, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.