Wesco investigates cybersecurity incident after data extortion group claims breach

Wesco is examining a cybersecurity incident tied to its cloud-based customer relationship management system after the data extortion group ExfilSquad claimed to have stolen and published company records.

Jennifer Sniderman, Vice President of Corporate Communications at Wesco, said the matter centers on the company’s cloud CRM environment. "Wesco is aware of a claim of CRM data exfiltration by a third party," Sniderman said. "We have worked with our cloud CRM vendor on the matter, and we do not believe that there is a risk to sensitive data."

Sniderman said Wesco has not experienced any disruption to its business and that operations are continuing normally. The company said its internal review identified the incident quickly and turned up no signs of ransomware or other malicious software affecting its broader IT infrastructure.

"We do not believe that payment card information, financial account information or other sensitive customer or employee data is at risk," the company stated.

ExfilSquad has claimed responsibility for stealing roughly 2.6 million records from Wesco, alleging the data includes customer and employee personal information, account and contact details, CRM user profiles, credit and business identification data, authentication metadata, and access credentials. The group published the material after a deadline it set for ransom negotiations passed without a deal.

Wesco has not confirmed the specifics of ExfilSquad’s claims, and the company did not respond to additional questions on the matter.

Wesco, a distributor of electrical, electronic, communications, security, utility, and broadband products that also provides logistics and supply chain services, is a Fortune 500 company with about 21,000 employees. It operates more than 700 distribution centers, fulfillment centers, and sales offices in roughly 50 countries, and reported approximately $24 billion in sales last year.

ExfilSquad has previously claimed breaches involving Analog Devices, the United Kingdom’s Police National Legal Database, and Newcastle University. Security researchers at Resecurity and VenariX, who have studied the group’s activity, have found that it has targeted misconfigured Microsoft Power Pages data tables in past incidents. Wesco has not disclosed how its systems were accessed, though publicly available information suggests the company may use Microsoft Dynamics 365.