Threat Actor Claims Azure Employee-Directory Data Stolen From Multiple Major Companies
Summary
A threat actor claims to have taken millions of employee-directory records from several companies’ Azure tenants using compromised credentials. Researchers say samples appear authentic, but the intrusion method is unconfirmed.
Key points
- The actor known as TheHatman advertised records attributed to nine companies, including McDonald’s, TCS, Vodafone, HCL Technologies and Kyndryl.
- The claimed datasets range from about 9,000 to more than 1.7 million records per organization.
- Reported fields include employee names, corporate emails, phone numbers, job details, reporting relationships, group memberships and service-account or administrator listings.
- The article says samples appear highly likely to be authentic, but the companies’ exposure and the actor’s claims are not independently confirmed in the supplied content.
- The actor says compromised credentials were used; the precise access method is unknown.
- Researchers found infostealer-linked Azure credentials associated with employees at several affected companies, but a direct link to the campaign is not confirmed.
- Exposed directory details could support targeted phishing, business email compromise and attacks aimed at privileged accounts.
Article Details
- Victim Organization
- McDonald’s Corporation; TCS (Tata Consultancy Services); Vodafone; HCL Technologies; InterContinental Hotels Group (IHG); Kyndryl; Gap Inc.; Hexaware Technologies; Wyndham Hotels
- Incident Type
- Threat actor advertised and offered for sale purportedly exfiltrated employee directory data, allegedly downloaded from the organizations’ Azure tenants using compromised credentials. Researchers described the samples as likely authentic but said the attack vector was inconclusive.
- Disclosure Date
- 2026-08-16
- Data Types Exposed
- Full names
- Corporate email addresses
- Phone numbers
- Physical addresses
- Employee IDs
- Job titles
- Departments
- Notes
- Manager details
- Direct reports
- User group memberships
- Service account information
- Global Administrator listings
- Affected Records
- The threat actor offered approximately 1,700,000+ McDonald’s records, 800,000+ TCS records, 425,000+ Vodafone records, 250,000+ HCL Technologies records, 185,000+ IHG records, 170,000+ Kyndryl records, 80,000+ Gap Inc. records, 20,000+ Hexaware Technologies records, and 9,000+ Wyndham Hotels records.
- Operational Impact
- Employee directory data was reportedly exposed and offered for sale. The article reports no confirmed operational disruption.
- Ransom Or Extortion
- No ransom demand is reported. The threat actor advertised the data for sale.
- Claim Status
- claimed
Threat Actors
Products
AzureMassive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (Mcdonald’s, Vodafone, Kyndryl & Others)Azure Active DirectoryHudson Rock’s cybercrime intelligence platform identifying compromised Azure Active Directory credentials belonging to an employee at TCS (Tata Consultancy Services), originating from a machine infected in India.CavalierBy leveraging Hudson Rock’s cybercrime intelligence and our flagship platform, Cavalier, security teams can detect compromised employee, user, and third-party credentials originating from Infostealers before threatEntraThese extensive directories were reportedly downloaded directly from the organizations’ Azure/Entra portals utilizing compromised credentials.
Countries
Industries
HospitalityThe campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics.IT servicesThe campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics.logisticsThe campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics.RetailThe campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics.TelecommunicationsThe campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics.