Threat Actor 'TheHatman' Sells Millions of Enterprise Records from Azure Dumps
A cybercriminal known as 'TheHatman' is selling massive employee directories from nine global enterprises, claiming the data was exfiltrated from Microsoft Azure using compromised credentials. While the samples appear genuine, the exact age and full scope of the breach remain unconfirmed by the affected companies.
Key points
- A threat actor named 'TheHatman' posted listings on cybercrime forums for employee directories from nine major corporations, including McDonald's, TCS, Vodafone, and Kyndryl.
- The actor claims to have extracted approximately 3.6 million records in total, with McDonald's allegedly accounting for over 1.7 million entries.
- The leaked data includes names, corporate emails, phone numbers, job titles, and privileged account details, which could facilitate targeted phishing and business email compromise attacks.
- Hudson Rock researchers found that the data samples match the structure of standard Microsoft Entra ID exports, though the exact intrusion vector is not definitively proven.
- TCS stated in a regulatory filing that the referenced data appears to be over four years old and that it has found no evidence of a breach in its systems.
Background
This incident follows a series of cloud and AI-related security breaches in 2026, including the Hugging Face AI agent breach and the Atlassian Rovo prompt injection flaw. These events highlight the increasing risks associated with compromised credentials and third-party integrations in enterprise environments.
How outlets are covering it
Hudson Rock and CRN Asia emphasize the link between Infostealer malware and the compromised credentials, suggesting that endpoint infections are the primary entry point. Security Affairs and Ransomnews focus on the technical authenticity of the samples, noting that while the data appears genuine, the lack of date fields makes it impossible to confirm the breach's timing. McDonald's and other affected companies have not publicly confirmed the exposure, with TCS specifically disputing the recency of the data.
Why it matters
The exposure of detailed corporate directories and privileged account information provides attackers with a roadmap for sophisticated social engineering and privilege escalation attacks, highlighting the critical need for robust multi-factor authentication and endpoint security.
What to watch
Organizations are advised to monitor for compromised credentials and enforce strict multi-factor authentication. Security teams should review privileged accounts and ensure that user enumeration is restricted in their cloud environments to prevent similar exfiltration campaigns.
- Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials InfoStealers
- McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen Security Affairs
- TCS, HCL, Hexaware named in global Azure directory data leak linked to infostealers CRN Asia
- Hackers Use Compromised Azure Credentials to Steal Millions of Enterprise Employee Records cyberpress.org
- McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records CyberSecurityNews
Want the full story? Read the original reporting
Read on InfoStealers