135,000 Police Records Left Through a Config Setting. AppOmni Published the Fix in November 2024.

The Police National Legal Database confirmed today that names, organisations and work email addresses belonging to UK police officers, police staff, criminal justice professionals and government partners are on a dark web leak site. A crew calling itself ExfilSquad posted samples on 26 July, claiming 135,000 PNLD records alongside roughly 607,000 from the Department for Education.

If you read that as a UK policing story you will take the wrong lesson from it. PNLD is one name on a list of fifteen, and the other fourteen include municipalities, schools, private companies and an airline. What connects them is not a country or a sector. It is a checkbox.

Nobody exploited anything

There is no CVE here. No patch, no proof of concept, no zero-day, and — this is the part worth sitting with — no intrusion in any sense a firewall would recognise.

Microsoft Power Pages lets an organisation stand up a public web portal in front of a Dataverse database. That is the product working as intended. The failure is in how permissions get granted underneath it. Apply the Anonymous Users web role to a table, give that table permission an Access Type of Global Access, leave the Web API enabled with its fields value set to the wildcard *, and the portal will return every row and every column of that table to anyone who asks.

Asking looks like an HTTP GET against a documented endpoint. Attackers query paths like /_api/<table> and /_odata and page through the result set. No credentials are presented, so no authentication fails. No exploit is thrown, so no signature fires. From the server's point of view a visitor requested public data and the server served it, which is exactly what it was configured to do.

You cannot patch this, because nothing is broken.

Twenty months

Here is the part that should sting.

Aaron Costello, then Chief of Security Research at AppOmni, published this research on 14 November 2024. He named the settings, demonstrated the extraction, and quantified how common it was. One line from his write-up has aged into an indictment: across the entirety of his testing, not a single implementation of column-level security was present.

ExfilSquad surfaced on 26 July 2026 with fifteen victims already harvested.

That is twenty months between a security researcher publishing the exact configuration, the exact endpoints and the exact remediation — for free, in public — and an extortion crew industrialising it. Nobody needed to discover anything. The map was on the table the whole time, and the people who eventually picked it up were not the defenders.

We write a lot here about the gap between a fix existing and a fix being applied. This is the widest one we have measured.

The victim list is the tell

VenariX, which analysed the campaign, verified two of the claims directly rather than taking the crew's word: an unauthorised party accessed a Frontier Airlines storage account on 9 July 2026, and Houston's 311 portal returned incident records without authentication, matching the published samples.

Look at the spread — a national police legal database, an education ministry, an airline, a city services portal. Power Pages is what an organisation reaches for when it needs a public-facing form in front of internal data and does not have a development team. Which means the install base is precisely the population with the least security staffing: local government, schools, small agencies, non-profits.

This is a harvest aimed, structurally rather than deliberately, at people who cannot afford to be harvested.

What to check tonight

If you run a Power Pages portal, this is a ten-minute audit and it is free:

Table permissions. Any table permission that pairs the Anonymous Users role with an Access Type of Global Access is publishing that table. Change the scope to user-owned or account-owned, or remove the anonymous role.

Webapi/&lt;table&gt;/fields. If this is *, replace it with an explicit list of the columns the page actually needs.

Webapi/&lt;table&gt;/enabled. Turn it off for any table that does not need API access. Most do not.

Authentication/Registration/OpenRegistrationEnabled. Set this to false unless you genuinely intend anyone to sign up.

Column security profiles. Enable them on PII columns and mask the values. Costello found this implemented zero times, which suggests most teams do not know it exists.

And one that catches people out: audit the Authenticated Users role as well. If open registration is enabled, anybody can become an authenticated user by filling in a form. Teams reason about that role as though it means staff. It does not. It means the public, one click later.

This is the other half of yesterday's problem

We published earlier today about three vendors shipping fixes that did not make the thing safe — an incomplete patch, a firmware update that cannot repair an existing seed, an embargo beaten by a same-day proof of concept. The shape there was that remediation and safety are not the same event.

This is the mirror image. There is no vendor to wait on, no version number to chase, and no advisory to receive. The fix has been available and documented for twenty months, costs nothing, and requires no downtime. It simply requires somebody to go and look at a settings page.

Both failure modes end in the same place, which is a defender who believes they are covered and is not. Only one of them is inside your control this evening.

What we are not publishing

There are no network indicators in this one. ExfilSquad's leak site addresses, infrastructure and handles have not been published by the parties who verified the campaign, and we are not going to reconstruct them from samples in order to have something to put in the feed. Nothing here goes into our indicator set, because there is nothing honest to put there.

The victims are also victims. The exposed records belong to police officers and civil servants who did nothing wrong, and they are not indicators either.

If hard infrastructure for this crew becomes available from a source we can cite, we will enrich it, corroborate it and feed it under a campaign source like anything else.

Confidence

Roughly 85%, and one caveat matters more than the others.

PNLD has not disclosed its root cause. It has confirmed the theft and the data types, and has said there is no evidence that passwords or other authentication data were taken. The Power Pages mechanism is what researchers assess as the likely route based on the campaign pattern and the shape of the leaked data — VenariX verified that route directly against Frontier Airlines and Houston 311, not against PNLD. Treat the mechanism as well-evidenced for the campaign and as inference for this particular victim, and we will correct this if PNLD publishes something different.

Everything else is firm and sourced: Costello's research and its publication date, the settings and remediation, the victim count, and the 26 July leak-site posting.

Credit where it belongs. Aaron Costello and AppOmni did this work in 2024 and gave it away. VenariX verified the campaign in 2026. We read both, checked it against our own corpus, and wrote down what to do about it tonight — which is all this post is.

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com