Microsoft Power Pages Leak Millions of Private Records

Executive summary: Misconfigured Microsoft Power Pages deployments and Dataverse access controls have left an estimated 5–7 million sensitive records exposed on the open web; examples include 1.1 million NHS employee records containing contact and address information. The issue stems from developers failing to implement site-level, table-level, and column-level protections (or allowing global/anonymous access) rather than evidence of active exploitation, creating a large-scale privacy and security risk.