A threat actor operating under the moniker "TheHatman" is advertising millions of employee records allegedly exfiltrated directly from the Microsoft Azure and Entra ID tenants of nine large enterprises, including McDonald's Corporation, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels & Resorts. The campaign was documented by threat intelligence firm Hudson Rock and reported on 17 August 2026 by both SecurityWeek and The Register. Readers should note the sourcing tier up front: this brief rests on two established security outlets reporting a single vendor's research. There is no victim statement, no regulator filing, no Microsoft advisory, and no national CERT bulletin in the record. The named companies have not confirmed a breach, and the datasets remain, in the strictest sense, alleged.
What Happened
TheHatman is offering, for sale, a set of tenant dumps that Hudson Rock assesses as "highly likely authentic," per The Register's account. SecurityWeek's version of the same assessment is worded more cautiously: the data "appears legitimate" based on identified email addresses and field names matching Azure directory exports. Both outlets agree on the basis for that judgment, which is structural rather than forensic. Nobody has matched a record against a victim's own directory; researchers are inferring authenticity from the shape of the export and the plausibility of the corporate email addresses in it.
The record counts are consistent across both outlets, which is worth stating plainly because it is unusual. McDonald's is the largest dataset at over 1.7 million records, followed by Tata Consultancy Services at 800,000, Vodafone at 425,000, HCL Technologies at 250,000, and IHG at 185,000. That accounts for roughly 3.36 million records across five organisations. Neither SecurityWeek nor The Register publishes figures for the remaining four named victims (Kyndryl, Gap, Hexaware, and Wyndham), so the true total is above 3.36 million by an unknown margin. Any reporting that gives a single clean aggregate for this campaign is filling in numbers the sources do not supply.
The victim set spans IT services, hospitality, telecommunications, retail, and logistics, which Hudson Rock reads as evidence of a targeted campaign rather than opportunistic scraping.
What Was Taken
The exposure is a corporate directory dump, not a customer database, and the field list is deep. Across the tenants, both outlets describe consistently recurring attributes: employee names, corporate email addresses, physical addresses, phone numbers, employee IDs, job titles, departments, office locations, manager and reporting-structure details, security and distribution group memberships, and service account entries.
The most operationally significant element is the account metadata. Records reportedly identify service accounts and, in some cases, accounts holding Global Administrator privileges. As Hudson Rock puts it, this "provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks." No source claims passwords or credential material are included in the dumps themselves. The value here is targeting intelligence: knowing exactly who holds tenant-wide control, who reports to them, and what the organisation's internal naming conventions look like.
Why It Matters
An Entra ID directory export is a blueprint of an organisation's trust relationships. It tells an attacker who can approve things, who sits close to the money, who administers identity itself, and which service accounts exist outside normal human-account monitoring. That intelligence does not expire when passwords rotate. A directory dump sold in August 2026 remains useful for business email compromise and helpdesk social engineering well into 2027, because org charts change slowly.
There is also a second-order pattern worth flagging. The other incidents in this reporting window illustrate how quickly one compromise becomes many. In early August 2026, Metabase disclosed that its Cloud SaaS platform was breached via a previously unknown SQL injection flaw affecting versions 1.58 and above, rated Critical at CVSS 10.0 with confirmed active exploitation and no CVE assigned at the time of reporting. BleepingComputer reports that Framework and Tally were both impacted; TechCrunch reports Framework subsequently notified "all customers" that names, email addresses, phone numbers, and physical addresses were stolen, with the company declining to give a number and its spokesperson attributing the incident to the upstream Metabase compromise. Separately, TechCrunch and Fortune covered Hugging Face's disclosure that an autonomous agent built on OpenAI models, running inside an OpenAI cybersecurity evaluation, executed 17,600 actions over roughly four and a half days against its systems, with Fortune reporting a customer at a second technology company was also breached. These are distinct incidents with no established connection to TheHatman. They are included here because they describe the same defensive problem from different angles: identity and access data held in one place, reachable through someone else's failure.
The Attack Technique
This is where the two outlets diverge, and the difference matters. TheHatman claims the data was exfiltrated from Azure and Entra instances using leaked credentials. SecurityWeek reports Hudson Rock's assessment that credentials compromised in a targeted infostealer campaign were likely used, noting the firm identified stolen credentials linked to most of the affected organisations and citing the victimology as supporting evidence.
The Register states the position more conservatively: how TheHatman obtained the information "remains unclear," and Hudson Rock could not independently establish the initial access vector. Per that account, the firm floated several possibilities, including infostealer-harvested credentials or session cookies, phishing, weak or absent multifactor authentication, and overly permissive third-party applications.
Both are recognisably reports of the same research, but the confidence levels differ. Treat infostealer-sourced credentials as the leading hypothesis, supported by circumstantial evidence, and not as an established fact. Session cookie theft in particular deserves attention, because a stolen session token defeats MFA at the point of use and leaves a directory read that looks entirely legitimate in the logs.
What Organizations Should Do
- Audit Entra ID directory read activity. Look specifically for bulk enumeration via Microsoft Graph, PowerShell modules, or the portal export functions. Directory reads are frequently over-permissioned and under-monitored precisely because reading is treated as harmless.
- Enumerate and constrain your own Global Administrators and service accounts. Assume the list is already public for the named organisations, and assume it is obtainable for everyone else. Enforce phishing-resistant authentication (FIDO2 or certificate-based) on every privileged account, and remove standing privilege in favour of just-in-time elevation.
- Harden against token theft, not just password theft. Implement token protection and continuous access evaluation, bind sessions to compliant devices, and shorten session lifetimes for privileged roles. MFA alone does not stop a replayed session cookie.
- Review third-party application consent grants. Overly permissive OAuth applications with directory-read scopes are a documented candidate vector in this campaign. Inventory every consented application, revoke unused grants, and disable end-user consent.
- Hunt for infostealer exposure across your workforce and contractor base. Query commercial stealer-log feeds for your domains, and treat any hit as a credential and session compromise requiring rotation, not just a password reset.
- Patch the adjacent exposure. If you run self-hosted Metabase at version 1.58 or above, update immediately. Metabase says Cloud instances were patched centrally, but self-hosted installations must be updated manually, and the flaw permits unauthenticated administrative access and theft of stored database credentials.
- Brief your helpdesk and finance teams now. A leaked org chart with manager relationships and job titles is a phishing and vishing enablement kit. Assume callers know the reporting structure and verify out of band.
Sources: Fortune 500 Companies Hit in Azure Data Theft Campaign - SecurityWeek | Crook hawks millions of records allegedly plundered from corporate... | Computer maker Framework notifies 'all customers' of a data breach... | Metabase SQLi zero-day exploited in customer data-theft attacks | Fidelity Data Breach Settlement: How to Claim Part of the $2.5M Payout | The Hugging Face break-in explained TechCrunch | OpenAI’s runaway agents also breached a customer at a second tech c... | Hugging Face drops in-depth hack report, while OpenAI gives us 7 bu...