microsoft.com
Jul 28, 2026
A sample data archive attributed to Microsoft, apparently exfiltrated from Microsoft Dynamics 365 CRM environments. The data includes facilities management contacts, incident/service request records, field technical representative/sales associate (FTRSA) contact records, and system user records. Fields include employee names, email addresses, job titles, phone numbers, organizational hierarchy data, Azure AD object IDs, and internal CRM metadata. The 'ExfilSquad' threat actor handle appears in the filename hint.
Data found in this dataset
Source files
Expand any file to inspect its column headers and the LLM's field-mapping reasoning, recorded during ingestion.
microsoft_samples__facilities_management__contacts_sample__records.csv10 columns300 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 73 | skip | high | header "birthdate" resolves to PII field "dob" |
| 80 | suffix | high | header "suffix" resolves to PII field "suffix" |
| 141 | firstName | high | header "firstname" resolves to PII field "firstName" |
| 240 | middleName | high | header "middlename" resolves to PII field "middleName" |
| 259 | high | header "emailaddress1" resolves to PII field "email" | |
| 263 | skip | high | header "emailaddress2" resolves to PII field "email" |
| 264 | skip | high | header "mobilephone" resolves to PII field "phone" |
| 295 | username | high | header "nickname" resolves to PII field "username" |
| 298 | lastName | high | header "lastname" resolves to PII field "lastName" |
| 378 | fullName | high | header "fullname" resolves to PII field "fullName" |
Notes: Heuristic auto-detection: header-named PII columns confirmed by data conformance
microsoft_samples__facilities_management__incidents_sample__records.csv2,108 rows
File structure
Notes: Pre-LLM auto-detection: free-form text with visible emails / phones
microsoft_samples__ftrsa_sample__records.csv7 columns989 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 6 | high | [6] header 'emailaddress1', values contain @microsoft.com and other email addresses | |
| 9 | firstName | high | [9] header 'firstname', values are given names like 'ZhiKai', 'Eva', 'Chelladurai' |
| 15 | lastName | high | [15] header 'lastname', values are surnames like 'Zhou', 'Wang', 'Petchimuthu' |
| 24 | state | high | [24] header 'address1_stateorprovince', sample value 'WA' is a US state abbreviation |
| 45 | zip | high | [45] header 'address1_postalcode', values like '02150', '98029' are postal codes |
| 48 | address1 | high | [48] header 'address1_composite', values contain full street address strings |
| 56 | high | [56] header 'emailaddress3', value 'mleloup@prodware.be' is a valid email address |
Notes: 80 columns total; most are CRM metadata, OData annotations, internal GUIDs, flags, and timestamps. PII is limited to first name, last name, two email fields, state, zip, and composite address. Column 25 'yomimiddlename' is a phonetic reading field but had no sample values — skipped due to no evidence of actual PII content. Column 53 'governmentid' had no sample values present in the excerpt — skipped due to insufficient evidence.
microsoft_samples__systemusers_sample__records.csv6 columns1,000 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence | LLM assessment |
|---|---|---|---|
| 15 | middleName | high | [15] header 'middlename', standard CRM middle name field |
| 50 | firstName | high | [50] header 'firstname', values are common given names: Ashish, Isa, Anna, Andrei, Denise |
| 54 | skip | high | [54] header 'title', values are job titles (SR MARCOM MGR) — honorific/job title prefix, not a generational suffix, skip |
| 60 | skip | high | [60] timezoneruleversionnumber — internal metadata |
| 61 | high | [61] header 'internalemailaddress', values contain email addresses including v-deveig@microsoft.com | |
| 73 | skip | high | [73] header 'personalemailaddress', personal email address field |
Notes: 76 columns total from a Microsoft Dynamics 365 CRM system user export. Most columns are internal CRM metadata, OData annotations, Azure AD object IDs, flags, and lookup GUIDs. PII is limited: firstName (col 50), middleName (col 15), internalemailaddress (col 61), personalemailaddress (col 73). Column 54 'title' contains job titles (not honorifics or generational suffixes), mapped to skip. The _modifiedonbehalfby formatted value (col 57) and _queueid formatted value (col 68) contain full names as display labels but are OData lookup annotations, not dedicated name columns — these are derivative/display values and not primary PII columns. No lastName, phone, DOB, SSN, address, or other PII columns are present in this sample.