A threat actor using the alias "TheHatman" began listing employee databases for sale on underground forums on July 31, 2026, claiming the data was pulled directly out of the Microsoft Azure and Entra ID tenants of at least nine large global enterprises. The named organizations are McDonald's, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, InterContinental Hotels Group (IHG), Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels & Resorts. The seller claims a combined total of roughly 3.64 million records (BleepingComputer and IDStrong both cite 3.64 million; The Register and SecurityWeek describe the haul only as "millions"). Hudson Rock, the firm whose research underpins most of the press coverage, assessed the samples as "highly likely authentic." At least one named company, TCS, formally disputes that it was breached, and Microsoft had not issued a public statement on the claims as of IDStrong's August 22 write-up.
What Happened
Beginning July 31, 2026, TheHatman posted a series of separate listings, one per organization, each advertising an employee dump from a named corporate Azure tenant. The listing language is consistent across posts. BleepingComputer quotes the McDonald's advertisement directly: "I'm selling McDonald's Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials." The TCS listing uses near-identical phrasing.
The datasets are described as exports from Microsoft Entra ID, the identity and access management directory underpinning Microsoft cloud tenants, rather than from customer-facing applications or consumer account systems. This is an important scoping distinction: on the available evidence this is corporate directory exposure, not a customer data breach.
Hudson Rock's assessment of authenticity rests on structural indicators rather than victim confirmation. Per The Register and SecurityWeek, the firm cited corporate email addresses and field names consistent with genuine Azure directory service exports. That is a reasonable signal, but it is an inference from format, not proof of a 2026 intrusion, and it does not by itself distinguish a fresh export from an older one recirculated.
What Was Taken
Per-organization figures reported by The Register and SecurityWeek, both drawing on Hudson Rock:
- McDonald's: approximately 1.7 million employee records (the largest single dataset, consistent across all four reporting outlets)
- Tata Consultancy Services: more than 800,000 records
- Vodafone: approximately 425,000 records
- HCL Technologies: approximately 250,000 records
- IHG Hotels & Resorts: approximately 185,000 records (reported by SecurityWeek; The Register lists IHG among the nine without a figure)
- Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels: named as victims, with no per-organization counts published
The advertised field set is broader than a simple name-and-email list. Across the sources, the consistently reported attributes are employee names, employee IDs, corporate email addresses, job titles, phone numbers, postal or physical addresses, service accounts, and general tenant account records. The Register and SecurityWeek add departments, office locations, manager and reporting-structure details, and group memberships to that list.
The most operationally significant element is that some records reportedly flag accounts holding Global Administrator privileges. SecurityWeek quotes Hudson Rock: "The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations." No source reports that passwords or authentication secrets are included in the dumps.
Where the Accounts Differ
This is the part defenders should not gloss over. The sources genuinely conflict.
TCS, in a notification to the National Stock Exchange of India, said it investigated and found no "credible evidence of a breach of TCS systems or customer environments." It further stated that the advertised details appear to be at least four years old and contain only basic employee information, and that the attacker's claimed vector was password spraying and MFA fatigue, techniques against which TCS says it has had "strong safeguards in place for more than two years." IDStrong notes that several of the named companies dispute the claims, though it does not enumerate which beyond TCS.
That regulator filing is the highest-tier evidence in this set, and it points in a different direction than the seller's marketing. TCS's account is compatible with the format-based authenticity assessment: a real, correctly structured Entra export can still be years old and sourced from somewhere other than a live 2026 tenant compromise. Treat "3.64 million records stolen from nine Fortune 500 Azure tenants in July 2026" as a seller's claim that is partially corroborated on data structure and directly contested on provenance and recency by at least one named victim. No named organization has confirmed a 2026 Azure tenant intrusion.
The Attack Technique
How TheHatman actually obtained the data is not established. The actor claims compromised credentials used to authenticate to Azure and Entra tenants directly. The Register reports that Hudson Rock could not independently confirm the initial access vector and floated multiple possibilities: credentials or session cookies harvested by infostealer malware, phishing, weak or absent multifactor authentication, and overly permissive third-party applications.
Hudson Rock leans toward the infostealer hypothesis. Per SecurityWeek, the firm identified stolen credentials linked to most of the affected organizations and argued the victimology, spanning IT services, hospitality, telecommunications, retail, and logistics, suggests a targeted campaign rather than opportunistic collection.
That hypothesis is at least environmentally plausible. Microsoft's own threat intelligence, published July 16, 2026, documented increased ACR Stealer activity across customer environments from late April through mid-June 2026, driven by ClickFix social engineering lures and explicitly aimed at "browser credentials, authentication tokens, and sensitive documents from enterprise environments." Microsoft warned that successful compromise can enable "account compromise, unauthorized access to cloud resources, and follow-on intrusion activity." That is a precise description of the mechanism Hudson Rock proposes, occurring in the window immediately before these listings appeared. It is supporting context, not attribution: no source links ACR Stealer to TheHatman.
Set against that, TCS's filing says the attacker claimed password spraying and MFA fatigue. Those are different techniques from infostealer credential theft. The claimed vector is therefore inconsistent across accounts, which is itself a reason for caution about the seller's narrative.
Why It Matters
A directory dump without passwords reads as low severity until you consider what it is actually good for. A complete Entra export is a targeting package. Reporting structures tell an attacker who can plausibly email whom. Job titles and departments identify who approves payments, who resets credentials, and who administers infrastructure. Office locations support pretexting. Group memberships reveal access boundaries. And flagged Global Administrator accounts and service accounts convert a broad organization into a short, ranked list of high-value targets. As The Register put it, even without passwords, knowing who holds the keys to the kingdom makes for a handy phishing shortlist.
Service account exposure carries separate weight. Service accounts are frequently excluded from MFA enforcement and conditional access policies for operational reasons, are rarely rotated, and often hold standing privilege. Naming them publicly narrows an attacker's search space considerably.
TCS's four-year-old assessment, if accurate for the other datasets too, reduces the operational value but does not eliminate it. Corporate hierarchies churn, but employee IDs, email address conventions, tenant naming schemes, and long-lived service accounts frequently do not.
The wider point for defenders is that identity has become the perimeter, and the credential is the payload. The parallel Microsoft ecosystem activity this summer reinforces how many roads lead into a tenant: Rapid7 and Microsoft disclosed an unauthenticated SharePoint RCE chain combining CVE-2026-55040, a JWT token validation authentication bypass, and CVE-2026-63520, an unsafe .NET type instantiation flaw in Business Connectivity Services rated CVSSv3.1 8.1, with both disclosed by August 11, 2026. Separately, Microsoft confirmed a researcher-demonstrated AI worm capable of self-propagating through Copilot-assisted Word document workflows. None of these are connected to TheHatman's listings, but together they describe the surface area an identity-focused actor is working against.
What Organizations Should Do
- Audit and inventory privileged identities now. Enumerate every Global Administrator and privileged role assignment in your Entra tenant, eliminate standing privilege where possible, and move to just-in-time elevation via Privileged Identity Management. Assume the list of who holds these roles may already be public.
- Bring service accounts into the identity program. Inventory them, rotate their credentials, scope them to least privilege, restrict them by conditional access and IP or workload identity where feasible, and remove any that are dormant. These are the accounts most likely to be exempted from MFA and most likely to be targeted next.
- Harden against the claimed vectors specifically. Enforce phishing-resistant MFA such as FIDO2 or certificate-based authentication for all privileged accounts, disable legacy authentication protocols that bypass conditional access, enable number matching to defeat MFA fatigue, and turn on smart lockout and password protection to blunt password spraying.
- Hunt for infostealer-derived access. Following Microsoft's ACR Stealer guidance, monitor for ClickFix lures, suspicious WebDAV activity, obfuscated PowerShell execution, MSHTA usage, and attempts to read browser credential stores. Revoke refresh tokens and active sessions for any user whose endpoint shows stealer indicators, since token theft defeats MFA at the point of use.
- Review sign-in and directory-export telemetry retroactively. Query Entra sign-in logs and audit logs for anomalous bulk directory reads, Microsoft Graph enumeration by unusual principals, and consent grants to third-party applications with directory read scopes. If the data is genuinely four years old, the relevant activity may sit outside your default retention window; check what you still have before assuming the absence of evidence is evidence of absence.
- Brief high-risk staff and patch the adjacent surface. Warn executives, finance approvers, IT administrators, and help desk staff that a detailed org chart may be in criminal hands, and reinforce out-of-band verification for credential resets and payment changes. In parallel, confirm SharePoint Server instances are patched for CVE-2026-55040 and CVE-2026-63520, for which a proof of concept is now public.
Sources: What You Need to Know about the Microsoft Azure Employee Data Breac... | Microsoft SharePoint JWT Token Authentication Bypass Technical Anal... | Rapid7 and Microsoft disclose CVE-2026-63520, a new SharePoint Remo... | ACR Stealer: Two observed intrusion chains amid increased threat ac... | Hacker claims 3.6 million Azure account records stolen from major c... | Crook hawks millions of records allegedly plundered from corporate... | Fortune 500 Companies Hit in Azure Data Theft Campaign | Microsoft confirms an AI worm is propagating through Copilot and ot...