ExfilSquad appeared on July 26, 2026 with a Tor leak site and a simultaneous dump of roughly 14–15 victim names — Microsoft, Zenith Bank, the cities of Houston and Atlanta, Frontier Airlines, and more — claiming a combined volume over 115 million records. Independent trackers such as GalaxyWarden documented the listings; researchers and reporters (including RuntimeWire and IT-Connect) stress that public evidence remains thin and that fabrication or recycled data is currently more plausible than fourteen verified megabreaches on one day.
This is not a confirmed multi-org breach roundup. It is a leak-site claim campaign that still drives phishing risk — especially for Houston residents and Frontier customers who already see real-world scams after any municipal or airline headline.
We audited each named organization’s primary public domain against the 100% ideal, probed website stacks, checked lookalike domains, and reviewed MFA docs (YubiKey / Google Authenticator) for the highest-visibility names.
Why skepticism is warranted
| Signal | What researchers note |
|---|---|
| Timing | Many listings posted seconds apart on launch day (RansomLook timing cited by RuntimeWire) |
| Proof | Little/no authenticated sample sets tying dumps to production systems |
| Microsoft claim | ~8M records / 130 GB / Aug 5 deadline — sample authenticity not confirmed (SOCRadar via IT-Connect) |
| Actor history | New public footprint; classified more as exfiltration/extortion branding than a proven encryptor family |
| Scale disparity | Claims range from ~90M (Zenith) to ~135K (PNLD) announced together |
Treat every row below as an attacker assertion until the named org confirms, regulators file, or authenticated samples are validated.
Alleged victims (attacker claims)
Volumes and data types below follow the public ExfilSquad / GalaxyWarden-style summaries circulating after July 26, 2026. They are not EmailMeNow confirmations.
| Organization | Sector | Claimed volume | Domain |
|---|---|---|---|
| Microsoft | Technology (USA) | ~8M | microsoft.com |
| Zenith Bank Plc | Banking (Nigeria) | ~90M | zenithbank.com |
| City of Houston | Local government | ~6M | houstontx.gov |
| City of Atlanta | Local government | ~3M | atlantaga.gov |
| Frontier Airlines | Airline | ~2.4M | flyfrontier.com |
| TaylorMade / Sun Day Red | Golf equipment | ~2M | taylormade.com |
| Allstate | Insurance | ~657K | allstate.com |
| Bonava | Real estate (Nordics) | ~842K | bonava.com |
| Analog Devices | Semiconductor | ~570K | analog.com |
| Newcastle University | Higher ed (UK) | ~440K | ncl.ac.uk |
| Viavi Solutions | Test & measurement | ~430K | viavisolutions.com |
| Police National Legal Database | UK justice data | ~135K | pnld.co.uk |
| UK Dept for Education | UK government | ~600K | education.gov.uk |
| DC Public Schools | K–12 (Washington, DC) | Unspecified | dcps.dc.gov |
Claimed data themes (by listing): PII and contacts; banking/account fields (Zenith); municipal service tickets (Houston/Atlanta); airline support/travel cases (Frontier); orders/shipping (TaylorMade); HR/recruiting (Allstate); property/warranty (Bonava); applicant/student contacts (Newcastle); enterprise IDs (Viavi); force-area contacts (PNLD); parent/staff help-portal entries (DfE).
Some feeds also list Wesco International (~2.6M) in the same launch wave (GalaxyWarden) — outside the 14-name table above.
Texas angle — City of Houston & Frontier
GalaxyWarden’s Houston write-up restates the listing’s ~6M municipal CRM / service-request narrative (contacts, addresses, complaint text). That material — if real — would fuel highly convincing “311 / utility / citation” phishing. Separately, Frontier already faces a documented 2026 incident and lawsuits tied to Scattered Lapsus$ Hunters, not ExfilSquad (our Frontier coverage). ExfilSquad’s ~2.4M Frontier claim should not be conflated with that confirmed case.
Independent cybersecurity audits
EmailMeNow audits on August 2, 2026. 100% is the ideal overall score — 0 of 14 reached it. Scores measure public identity / transport / website posture, not whether ExfilSquad’s dump is real.
| Organization | Domain | Overall | Identity | Transport | Website |
|---|---|---|---|---|---|
| Bonava | bonava.com | 76% | 70% | 15% | 92% |
| Frontier Airlines | flyfrontier.com | 74% | 65% | 15% | 92% |
| Viavi Solutions | viavisolutions.com | 70% | 75% | 15% | 65% |
| Microsoft | microsoft.com | 68% | 90% | 70% | 45% |
| Analog Devices | analog.com | 63% | 75% | 15% | 40% |
| Newcastle University | ncl.ac.uk | 61% | 65% | 70% | 37% |
| Allstate | allstate.com | 60% | 65% | 40% | 40% |
| Zenith Bank | zenithbank.com | 58% | 65% | 15% | 37% |
| UK Dept for Education | education.gov.uk | 55% | 50% | 70% | 37% |
| City of Houston | houstontx.gov | 52% | 50% | 15% | 37% |
| Police National Legal Database | pnld.co.uk | 47% | 35% | 15% | 40% |
| City of Atlanta | atlantaga.gov | 42% | 25% | 15% | 37% |
| TaylorMade | taylormade.com | 42% | 25% | 15% | 37% |
| DC Public Schools | dcps.dc.gov | 30% | 0% | 15% | 42% |
Patterns:
- Transport ≤15% on 10 of 14 domains — spoofed “breach notification” and municipal/airline mail remain easy to deliver even when claims are fake.
- Strongest overalls: Bonava 76%, Frontier 74%, Viavi 70% — still short of 100%.
- Weakest: DCPS 30% (0% identity) and Atlanta / TaylorMade at 42%.
- Microsoft 68% with 90% identity is relatively strong on spoofing controls, but website score lags.
Audit links: microsoft.com · houstontx.gov · flyfrontier.com · zenithbank.com · atlantaga.gov · dcps.dc.gov
MFA: YubiKey & Google Authenticator (spotlight)
Public docs only for the highest-visibility names. Grade: Fail = SMS/voice/email OTP; Partial = vendor soft token / push without open TOTP or YubiKey; Pass = open TOTP; Strong = FIDO/YubiKey.
| Organization | YubiKey / FIDO | Open TOTP | Grade |
|---|---|---|---|
| Microsoft | Yes (FIDO2) | Yes | Strong |
| Zenith Bank | Proprietary e-Token / hardware | No | Partial |
| Allstate (workforce) | Hardware + MS Authenticator | No (not open TOTP) | Partial |
| Frontier Airlines | Not documented | No (email/SMS codes reported) | Fail |
| City of Houston | Not documented | Not documented | Unevaluated |
Takeaway: Even if ExfilSquad’s dumps are hoaxes, residents and customers still need strong MFA on real bank, airline, and Microsoft accounts. Proprietary tokens (Zenith) and workforce Microsoft Authenticator (Allstate) are better than SMS-only — but vendor-locked apps without open TOTP are not a Pass, and SMS-class airline login codes remain a Fail.
Website stack note
Passive website-tech probes on August 2, 2026 across all 14 domains:
| Host | Notable signal |
|---|---|
| dcps.dc.gov | Drupal 7 (EOL / far behind current Drupal) |
| ncl.ac.uk | HubSpot; jQuery 1.10.2 EOL hint |
| Other 12 hosts | No notable CMS/PHP aging bullets in this pass |
Stack age does not prove ExfilSquad access. Outdated Drupal at DCPS is still a hygiene flag worth fixing independently.
Lookalike / cybersquat scans
| Brand domain | Lookalikes to review | Notes |
|---|---|---|
| houstontx.gov | 8 | houstontx.com / .net / .io and peers registered — spoof-adjacent for city phishing |
| flyfrontier.com | 40 | Dense typo-squat set (flyfronteir.com, flyfroniter.com, …) with MX on many |
| microsoft.com | 45 (27 point at brand) | Microsoft already defensively owns many omissions/TLD swaps |
Fake “City of Houston data breach help desk” or “Frontier miles recovery” sites on lookalikes are the practical risk from this campaign — whether or not any dump is authentic.
Priority actions
If you live in Houston or fly Frontier:
- Ignore cold calls/emails citing ExfilSquad, “6 million Houston records,” or “Frontier 2.4M leak payout.” Verify only via houstontx.gov or flyfrontier.com published channels.
- For Frontier’s confirmed earlier incident, see Frontier lawsuits / Scattered Lapsus$ Hunters.
- Prefer authenticator apps / FIDO over SMS for Microsoft, banking, and insurance logins.
For named organizations:
- Publish a short confirm / deny / investigating statement — silence amplifies leak-site fiction.
- Assume phishing spikes: DMARC
p=reject, MTA-STS enforce, and callback-only verification for aid, payroll, and municipal payments. - Drive domain scores toward the 100% ideal; transport at 15% is the recurring gap on this list.
Related coverage
- Ransomware threat landscape — how to use public victim trackers
- Frontier Airlines breach lawsuits (Scattered Lapsus$ Hunters)
- Houston City College / ShinyHunters (separate June 2026 education leak)
- Government & education breaches
- MFA support directory
Protect inboxes during unverified leak-site waves.
Run a free Instant Cybersecurity Audit at audit.emailmenow.com or contact EmailMeNow IT Consulting.
Sources: GalaxyWarden — ExfilSquad tracker · GalaxyWarden — City of Houston listing · RuntimeWire — Microsoft claim unverified · IT-Connect — ExfilSquad / Microsoft evidence thin · WatchGuard — ExfilSquad profile · EmailMeNow audits Aug 2, 2026