A threat actor operating under the alias "TheHatman" is selling internal employee directories allegedly exfiltrated from the Azure and Entra ID tenants of at least nine Fortune 500-scale enterprises, according to reporting published August 16, 2026 by Hudson Rock's InfoStealers research blog and Cyber Security News. McDonald's Corporation is the largest named victim at more than 1.7 million records, followed by Tata Consultancy Services at roughly 800,000, Vodafone at approximately 425,000, and HCL Technologies at around 250,000. Hudson Rock researchers who reviewed sample datasets describe the data as "highly credible," citing corporate email domains and field structures that align precisely with standard Azure directory exports. Readers should note the sourcing floor here: as of publication, no named victim, regulator, or Microsoft advisory has confirmed the campaign. Both accounts trace back to the same underlying Hudson Rock analysis of seller listings, so the record counts are the actor's claims as validated against samples, not victim-confirmed figures.
What Happened
Over roughly one week, TheHatman flooded underground forums with listings covering IT services, hospitality, telecommunications, retail, and logistics victims. The seller claims the records were pulled directly from victim organizations' Azure and Entra portals using compromised credentials, rather than through exploitation of a Microsoft platform vulnerability. That distinction matters: nothing in the available reporting alleges a flaw in Azure itself.
The claimed victim list and volumes, as reported by Cyber Security News from the same Hudson Rock review:
- McDonald's Corporation: 1.7 million+ records
- Tata Consultancy Services: ~800,000
- Vodafone: ~425,000
- HCL Technologies: ~250,000
- InterContinental Hotels Group: ~185,000
- Kyndryl: ~170,000
- Gap Inc.: ~80,000
- Hexaware Technologies: ~20,000
- Wyndham Hotels: ~9,000
The two published accounts do not conflict on these numbers, but they are not independent of one another either. Hudson Rock's own post names McDonald's, Vodafone, and Kyndryl in its headline and describes the campaign as "currently underway." Treat all totals as a single-source estimate pending victim notification or regulatory filing.
What Was Taken
The leaked datasets reportedly follow a consistent template across victims, which is itself evidence of automated directory export rather than opportunistic scraping. Core fields include full names, corporate email addresses drawn from both active company domains and tenant-specific onmicrosoft.com structures, phone numbers, and physical addresses.
Beyond contact data, the dumps expose organizational structure: employee IDs, job titles, departments, manager assignments, and direct reports. The most consequential category, per Hudson Rock's review, is access and group mapping information, including service account details. That combination converts a directory dump from a privacy incident into an attack-planning asset. An adversary holding manager-to-report chains plus group membership can identify approvers, finance authority, and IT staff without touching the network again.
No password hashes, authentication material, or customer records are alleged in the reporting reviewed for this brief. The exposure appears to be workforce identity data, not consumer PII.
Why It Matters
Directory exports are the reconnaissance layer for the attacks that follow. The Dutch National Police investigation into the February 2026 Odido breach illustrates the pattern precisely: police said they found "strong indications" of Dutch involvement, including a phone call placed to Odido customer service shortly before the intrusion in which "a Dutch-speaking man posed as Odido's IT employee." The company was then misled through phishing before data theft occurred. Odido disclosed that attackers reached its customer contact system on February 7 and told local media the breach affected 6.2 million customers, with exposed fields potentially including name, address, mobile number, customer number, email, IBAN, date of birth, and passport or driver's license details. Odido has not attributed the incident; BleepingComputer noted the ShinyHunters extortion gang in connection with it.
That is the downstream risk of a TheHatman-style dump. Knowing who the IT staff are, who they report to, and which service accounts exist is what makes an IT-helpdesk impersonation call convincing.
The regulatory tail is also real, and Vodafone is the standing example. Germany's BfDI fined Vodafone GmbH a combined 45 million euros over two distinct failures, in a decision dated March 10, 2025 and disclosed via BfDI press release, a European Data Protection Board case summary dated June 10, 2025, and the BfDI's 2025 annual activity report. PPC Land and Noah Intelligence agree on the 45 million euro total; Noah Intelligence adds a split not present in the PPC Land excerpt, attributing 15 million euros to inadequate supervision of partner sales agencies and 30 million euros to an authentication weakness in Vodafone's online portal and telephone hotline that let unauthorized third parties access other customers' eSIM profiles. The EDPB summary found "weaknesses in the IT systems leading to the risk of customer data being misused for fraud," and noted that "such risks actually materialized in some cases." That fine stems from long-running investigations, not from the Azure campaign, and the two should not be conflated. It does establish that European regulators are already treating Vodafone's identity and access controls as a supervised area.
Vodafone's exposure history is long. In March 2010, Panda Research found a Vodafone-distributed HTC Magic handset shipping with a modified Mariposa bot client, along with Conficker and a Lineage password stealer, on its external storage. Vodafone called the incident isolated and opened an investigation. Sixteen years apart, the through-line is supply and distribution chains that touch customer devices and data.
The Attack Technique
The initial access vector is the weakest-evidenced part of this story. The seller claims compromised credentials against Azure and Entra portals. Hudson Rock is an infostealer intelligence vendor, and the campaign is being reported on its InfoStealers property, which points toward stealer-harvested credentials as the presumed source, but neither published account states a confirmed acquisition path, a specific stealer family, or whether multifactor authentication was bypassed, absent, or defeated via token theft. Anyone repeating an infostealer attribution as fact is going beyond what the sources support.
What the uniform data structure does suggest is that once inside, the actor used legitimate directory export functionality rather than custom tooling. A bulk Entra directory export by an account with sufficient read permissions generates the exact field set described, and produces little that looks anomalous to controls tuned for malware.
For contrast on how a different initial vector plays out, KDDI's June 2026 breach was a zero-day exploitation rather than a credential compromise. The Japanese carrier confirmed unauthorized access to an email infrastructure system serving five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE), with mobile and fixed-line email services unaffected. Figures and dates vary between accounts. SecurityWeek reported the incident as occurring June 17 and cited 12.2 million exposed email addresses and 7.6 million passwords, with an automated translation of KDDI's notice suggesting ISPs had been affected since May. BleepingComputer, citing a July 6 KDDI update, reported that attackers first breached the platform on May 16 and that June 17 was the confirmation date, with exact totals of 12,233,087 email addresses and 7,616,173 passwords, and a wider upper bound of up to 14.22 million current, former, and inactive accounts. KDDI said the vulnerability was unknown to the software vendor as of June 17 and that the vendor has reported it to public authorities. Some passwords were stored hashed and/or encrypted; KDDI did not specify how many were plaintext or what encryption was used. The company says it evicted the attackers immediately, has seen no further suspicious activity, and is completing a mandatory password reset. The best reading is that both outlets describe the same event with BleepingComputer's later update superseding the earlier framing.
What Organizations Should Do
- Hunt for bulk directory reads now. Query Entra ID audit and MicrosoftGraphActivityLogs for large-volume
/users,/groups, and/servicePrincipalsenumeration, especially from non-standard clients, unfamiliar ASNs, or accounts with no history of administrative queries. This is the detection that would have caught the described activity. - Audit who can export the directory. Directory Readers, Global Reader, and any application registration holding
User.Read.AllorDirectory.Read.Allshould be inventoried and justified. Read-only permissions are routinely under-reviewed precisely because they cannot change anything. - Assume infostealer exposure and rotate accordingly. Check corporate domains against stealer log feeds, revoke refresh tokens for any hit, and enforce phishing-resistant MFA (FIDO2 or certificate-based) for privileged and service-adjacent accounts. Token theft defeats push-based MFA; hardware-bound credentials do not.
- Harden the helpdesk against the Odido playbook. Require callback verification or a manager-approved out-of-band channel before any password reset, MFA re-enrollment, or eSIM/SIM change. Anyone holding a directory export can already name your IT staff and their reporting lines.
- Scope service accounts and non-human identities. Service account details are specifically cited in the exposed field set. Migrate to managed identities where possible, apply conditional access to workload identities, and alert on service principal sign-ins from new locations.
- Pre-brief named employees on targeted phishing. If your organization appears on the victim list, staff should expect spearphishing that correctly cites their title, department, and manager. Warn them before the messages arrive, not after.
- Track the disclosure gap. No named victim has confirmed this campaign. Watch for 8-K filings, GDPR Article 33 notifications, and any Microsoft advisory, and be prepared for the confirmed figures to differ from the seller's claims in either direction.
Sources: McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposin... | 12 Million Impacted by Data Breach at Japanese Telco KDDI - Securit... | Telco giant KDDI says data breach affects over 12 million people | Police suspects Dutch hackers were involved in Odido breach | Massive Azure Exfiltration Campaign Exposes Millions of Enterprise... | BfDI fines Vodafone 45 million euros over eSIM and partner fraud gaps | Germany fines Vodafone €45 million over eSIM security flaws and par... | Vodafone Caught Distributing Botnet Via HTC Magic Phone (Updated)