It wasn't a hack.
This week's Power Pages data leaks hit millions of records across more than a dozen organisations. Not one exploit. The attackers sent ordinary Web API requests, anonymously, and the portals answered, because they were configured to.
I've audited Power Pages sites for years. The pattern is always the same: table permissions scoped wider than anyone remembers, the Anonymous Users web role holding rights nobody granted on purpose, and "temporary" wildcard settings from the dev phase still live in production.
None of this shows up in a feature test. The portal works perfectly, for your users, and for everyone else. That is exactly why it hides.
Two things you can do today: run Microsoft's free Site Checker, it catches the obvious cases. Or get independent eyes on it. I offer a fixed-fee security audit, fixed scope, fixed price, a report your team can act on. Not because your developers aren't good, but because the people who built a configuration are the worst placed to spot what is wrong with it. That is true for me too.
If this week made you wonder about your own site: good, that instinct is correct. When did anyone last look at your portal's permissions with fresh eyes?
