decrypted · 24 august 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

The Power Pages default that put UK police and school records on a leak site

A data-extortion crew calling itself ExfilSquad has spent the last month walking through the same unlocked door at more than a dozen organisations, and two of them are arms of the British state. The mechanism wasn't a vulnerability in the traditional sense: no CVE, no patch Tuesday entry. It was a checkbox left in the wrong position on Microsoft's low-code platform, and it is a tidy illustration of what Secure by Design actually means when nobody's watching.

What ExfilSquad found

Researchers at VenariX, and separately at Fortra, traced the breach to Microsoft Power Pages, the platform organisations use to spin up public-facing web portals backed by Dataverse, Microsoft's cloud database. Power Pages lets an administrator grant an "Anonymous Users" web role: intended for genuinely public content, such as an FAQ page. The trouble starts when that role gets applied, deliberately or by inheritance, to a Dataverse table holding something sensitive. From that point, anyone who knows the portal's address can query it directly through its API, no login required, and pull the underlying records straight out.

ExfilSquad didn't need to write any exploit code. It ran queries against the public routes of portals built this way, found which ones answered, and helped itself. By early August the group had published roughly 27 million records taken from 13 organisations, including the UK's Police National Legal Database (PNLD), used by all 43 Home Office police forces, and the Department for Education. PNLD has confirmed over 100,000 records affected: names, employers and work email addresses of police officers, criminal justice staff and members of the public who used its "Ask the Police" service. Neither organisation has reported passwords or credentials among the stolen data, and PNLD says it has notified the ICO and is working with the National Crime Agency.

The lesson: defaults are decisions

This isn't really a story about one careless administrator. It's a story about a platform whose safe path and easy path point in different directions. Anyone building a Power Pages portal with a public section and a private one can end up applying the convenient role broadly rather than table by table, and unless they specifically test what an unauthenticated visitor can retrieve, they won't know they've done it until somebody else finds out for them. Microsoft's own guidance now tells customers to disable anonymous access by default, then open it up only where genuinely intended, and to test the portal's API routes from a logged-out session before assuming they're safe.

Secure by Design means the safe configuration is the one you get without trying. Any UK organisation running a Power Pages or similar low-code portal, and there are plenty across local government, education and policing, should treat this as a prompt to audit table permissions this week, not after the next leak site lists their name.

Also this week

Red Hat and the Keycloak project have patched a critical flaw, CVE-2026-18963 (CVSS 9.1), in Keycloak's password-reset flow. Keycloak is widely used for identity and access management across public sector and enterprise deployments. A broken step in the reset process let an attacker skip the email-verification link entirely and set a new password for any account, including admin ones, without credentials. Patches are out, in upstream Keycloak 26.7.2 and matching Red Hat builds. There's no evidence of exploitation yet, but "forgot password" is exactly the feature attackers try first, so this is one to patch before the weekend rather than after.

The government briefed energy company chiefs this week on hardening their defences, following the Iran-linked attack on a small UK power generator we covered here on Sunday. Energy minister Michael Shanks said the incident, contained to one small-scale generator with no impact on the wider grid, had prompted renewed work with the NCSC and regulators on interconnectivity risk across smaller operators: a sign the sector is treating this as a pattern to prepare for rather than a one-off.

Cisco Talos has detailed SPECTRE, a cross-platform implant used by a Chinese-speaking group it tracks as UAT-10147, which pairs a Linux kernel rootkit with a Windows technique that unlinks EDR products from the kernel's own callback list, blinding them to what happens next. Talos assesses with medium confidence that parts of the rootkit were AI-generated, based on tells like unusually thorough, tutorial-style code comments. That attribution is inference rather than certainty, but the group's target list ran to roughly 170,000 servers: a reminder that whoever, or whatever, wrote the code, the scale is very human-shaped.

Sources

Worried about what your own low-code portals or IAM defaults might be exposing? Get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.