Key takeaways
- ExfilSquad appeared on July 26, 2026, claiming fifteen organizations at once, including the municipal governments of Atlanta and Houston (both still alleged). The UK’s Police National Legal Database and Department for Education have confirmed data theft matching the group’s claims.
- PNLD confirmed roughly 114,000 subscriber records covering police officers and criminal justice professionals were stolen, plus about 21,000 public email addresses. It says it never even received a ransom demand.
- The group deploys no encryptor. In early August it began distributing what researchers describe as complete copies of victims’ stolen data via torrent files, a distribution method with no takedown lever.
- Nothing in the backup and recovery playbook applies to this attack. The only defense that changes the outcome is detecting and stopping the bulk read while data is leaving.
On July 26, 2026, a previously unknown extortion group calling itself ExfilSquad posted claims against fifteen organizations in a single day, including the municipal governments of Atlanta and Houston. According to public reporting from The Register, Cybernews, and Security Affairs, at least two claims have since been confirmed by the victims: the UK’s Police National Legal Database, a legal reference service used by police forces and criminal justice agencies, and the UK Department for Education. Other entries on the group’s leak site, including a claimed breach of a major Nigerian bank said to involve roughly 874 GB, remain unverified and should be treated as alleged.
PNLD confirmed on August 3 that attackers stole approximately 114,000 subscriber records, names, work email addresses, and organizational affiliations of police officers and criminal justice professionals, along with about 21,000 public email addresses from its "Ask the Police" site. Notably, PNLD said it never received a ransom demand. The first sign of the breach was the data appearing on a leak site.
No encryptor, no ransom note, no recovery playbook
ExfilSquad deploys no ransomware. Its entire model is exfiltration and publication: steal the files, post the claim, set a deadline. In early August, when its self-imposed negotiation deadline passed, researchers at Resecurity reported the group began sharing torrent files containing what appear to be complete copies of victims’ stolen data. Torrent distribution is the detail worth sitting with. A leak site can be seized or taken offline; a torrent seeded across a peer-to-peer network cannot be recalled by anyone, including the attackers.
This is the logical endpoint of a trend the extortion economy has been moving toward for two years. Encryption is noisy, operationally risky, and increasingly survivable for victims with good backups. Data theft is quiet, and its leverage grows the moment the files leave. IBM X-Force counted 109 distinct extortion groups operating in 2025, up 49 percent year over year, and a growing share of them look like ExfilSquad: no encryptor, just an exfiltration pipeline and a publication threat.
The only defensible moment is during the read
Strip the encryption out of the attack and look at what remains: a credentialed or unauthorized session reading files at bulk from production systems. For PNLD, that was on the order of 135,000 records. For the Department for Education, reporting puts the leaked set around 600,000 records. Reads of that shape, a session enumerating and copying data far outside any normal working pattern, are behaviorally distinct from legitimate use. They are also invisible to every tool that is not watching file operations on the systems where the data lives, across SMB, NFS, S3, and Web Drive.
Backups do not apply here; nothing was destroyed. Immutable vaults do not apply; nothing needs restoring. Once the torrent is seeded, legal remedies do not apply either. The window in which this attack can be defeated opens when the bulk read begins and closes when it finishes. Storage-layer behavioral detection exists for exactly that window: profile normal access, recognize the departure, terminate the session before the copy completes. Attribute-based access control narrows how much any one compromised account can reach in the first place, and a per-operation audit trail means a victim can state precisely what was taken rather than assuming the worst. PNLD learned the scope of its breach from a leak site. That, as much as the theft itself, is the failure mode to engineer against, and it could happen to any organization whose file estate is served without being watched.
Go deeper