exfilsquad
ransomware group · aka ExfilSquad · unknown · active since 2026-07-26 (first leak-site activity tracked on this dashboard)
Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
14
All-time (tracked)
14since 2026-07-26
Last post
07-30 09:32UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
ExfilSquad is a data-theft and extortion group that publishes victims on a dedicated leak site first tracked by this dashboard on 2026-07-26, with 14 victims listed through 2026-07-30. Its victim list spans high-profile government, education, technology, insurance, and industrial organizations across the United States, the United Kingdom, Europe, and West Africa, including Microsoft, Allstate, the City of Atlanta, the City of Houston, and the UK Department for Education. Independent researchers have confirmed the group's access to sensitive data across 13 of its listed organizations. Unusually for an extortion group, ExfilSquad has distributed some stolen datasets via public torrent networks in addition to its leak site. Its origin, initial access methods, and any ransom demands remain unknown in public reporting.
Tactics & tooling
- Publishes victim organizations on a dedicated data-leak site
- Distributes stolen datasets via public torrent networks in addition to the leak site
- Victim set includes multiple globally recognized brands and government entities
- Researchers confirmed access to sensitive data at 13 listed victim organizations
- Burst posting pattern: 14 victims listed within five days (2026-07-26 to 2026-07-30)
- Initial access vector and exploited vulnerabilities: unknown
Targeted sectors
government (municipal and national)educationtechnologyinsurancefinancial servicesmanufacturing and distributionconstructionairlines/transportation
Notable public victims
City of Atlanta (atlantaga.gov), City of Houston (houstontx.gov), Wesco International, Bonava, UK Department for Education (education.gov.uk), Police National Legal Database, Microsoft, Allstate, TaylorMade & Sun Day Red golf, Frontier Airlines
Estimated earnings
No public figure.
Leak-site victims14 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| City of Atlanta (atlantaga.gov) | · Jul 30, 2026 | — |
| City of Houston (houstontx.gov) | · Jul 30, 2026 | — |
| Wesco International | · Jul 30, 2026 | — |
| Bonava | · Jul 30, 2026 | — |
| UK Department for Education (education.gov.uk) | · Jul 26, 2026 | — |
| Police National Legal Database | · Jul 26, 2026 | — |
| Microsoft | · Jul 26, 2026 | — |
| Allstate | · Jul 26, 2026 | — |
| TaylorMade & Sun Day Red golf | · Jul 26, 2026 | — |
| Frontier Airlines | · Jul 26, 2026 | — |
| Zenith Bank Plc | · Jul 26, 2026 | — |
| District of Columbia Public Schools (dcps.dc.gov) | · Jul 26, 2026 | — |
| Newcastle University (ncl.ac.uk) | · Jul 26, 2026 | — |
| Viavi Solutions | · Jul 26, 2026 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .