TheHatman claims to sell 3.64 million records from major companies’ Azure tenants
Summary
TheHatman claims to be selling 3.64 million employee and tenant-account records from major companies’ Azure tenants. Hudson Rock says the data appears authentic, but the access and exfiltration methods are unknown; TCS and Gap report no evidence of a breach.
Key points
- TheHatman advertised alleged employee or tenant-account dumps tied to nine companies, claiming access through compromised credentials.
- The actor claimed the listings total 3.64 million records, including a dump of more than 1.7 million records attributed to McDonald’s.
- The advertised data includes employee contact details and, in some dumps, service accounts and administrator names.
- TCS said it found no credible evidence of a breach and that the data appeared at least four years old; Gap also reported no evidence of compromise and described its data as old and limited.
- Hudson Rock said the data had characteristics suggesting authenticity and could aid social engineering, but the access vector and exfiltration method remain unknown. BleepingComputer could not independently verify authenticity.
Article Details
- Victim Organization
- McDonald’s, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl
- Incident Type
- TheHatman claims to have accessed Azure and Entra tenant data using compromised credentials and stolen employee and tenant-account records. Tata Consultancy Services says the attacker claimed to use password spraying and MFA fatigue; the access and exfiltration methods have not been independently verified.
- Data Types Exposed
- Names
- Employee IDs
- Email addresses
- Job titles
- Phone numbers
- Postal addresses
- Service-account details
- Other tenant-account records
- Affected Records
- TheHatman claims 3.64 million records in total. Advertised dumps range from 9,000+ records for Wyndham Hotels to 1.7+ million for McDonald’s; the reported quantities and breach claims are not independently verified.
- Operational Impact
- No operational disruption or confirmed compromise is reported. Hudson Rock says the data includes service-account details and global administrator names that could facilitate social engineering and spearphishing. Tata Consultancy Services and Gap Inc. report finding no credible evidence of a breach; both describe the data as old, and Gap also says it is limited and non-sensitive.
- Ransom Or Extortion
- TheHatman advertised the alleged databases for sale and provided samples to potential buyers. No ransom demand is reported.
- Claim Status
- claimed
MITRE ATT&CK
T1078.004 · Cloud AccountsThe posts allege access to Azure tenants using compromised credentials; the claimed access has not been independently verified.T1110.003 · Password SprayingTata Consultancy Services says the attacker claimed password spraying as an attack vector; the claim is unverified.T1621 · Multi-Factor Authentication Request GenerationTata Consultancy Services says the attacker claimed MFA fatigue as an attack vector; the claim is unverified.
Threat Actors
Vendors
Products
AzureA threat actor known as TheHatman is selling alleged employee databases stolen from Microsoft Azure and Entra tenants of multiple Fortune 500 companies, including McDonald’s, Gap Inc., Vodafone, Tata ConsultancyEntraA threat actor known as TheHatman is selling alleged employee databases stolen from Microsoft Azure and Entra tenants of multiple Fortune 500 companies, including McDonald’s, Gap Inc., Vodafone, Tata Consultancy