Wesco Confirms Cloud CRM Incident After ExfilSquad Claims 2.6 Million Records Stolen

Global supply chain and distribution giant Wesco has confirmed it is investigating a cybersecurity incident after the data extortion group ExfilSquad claimed to have stolen sensitive information from the company and published it on its leak site, BleepingComputer reported Tuesday.

What Happened

Jennifer Sniderman, vice president of corporate communications at Wesco, said the incident involves the company's cloud CRM environment. We have worked with our cloud CRM vendor on the matter, and we do not believe that there is a risk to sensitive data, she said. Wesco said the incident was detected quickly and its investigation found no evidence of ransomware or other malicious software on its IT systems.

The Claim

ExfilSquad — known for prior breaches at Analog Devices, the U.K.'s Police National Legal Database and Newcastle University — claimed to have stolen 2.6 million records containing customer and employee PII, account and contact data, CRM user profiles, credit and business identifiers, authentication metadata and access information. After its deadline for ransom negotiations expired, the group published the allegedly exfiltrated data.

Researchers at Resecurity and VenariX examining ExfilSquad activity say the threat actor has previously targeted improperly configured Microsoft Power Pages data tables, and public information suggests Wesco may use Microsoft Dynamics 365. Wesco has not said how the breach occurred, and the company has not confirmed the accuracy of the 2.6 million-record figure claimed by the extortion group.