A threat actor using the alias TheHatman is advertising internal employee directories allegedly exfiltrated from the Microsoft Azure and Entra ID tenants of nine large enterprises, with the total haul claimed at 3.64 million records. Hudson Rock, which first documented the campaign, assessed the samples it reviewed as "highly likely authentic" based on corporate email addresses and field names consistent with a standard Azure directory export. Palo Alto Networks Unit 42 has since added the activity to its running threat brief on large-scale credential attacks, logging it as an August 2026 claim of credential theft from organisations' Microsoft Entra tenants. Only one named company has responded publicly, and it disputes the claim: Tata Consultancy Services told the National Stock Exchange of India it found no credible evidence of a breach.
What Happened
According to BleepingComputer, TheHatman began posting on 31 July 2026, then released a string of dumps over the following fortnight, with the largest advertisement, the alleged McDonald's data, appearing on Sunday 16 August on the forum DarkForum. Each listing carried the same pitch. "I'm selling McDonald's Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials," reads the post reproduced by both BleepingComputer and TechNadu.
The named organisations are consistent across every outlet reporting on the Hudson Rock research: McDonald's, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies and Wyndham Hotels. The Register describes the alleged haul as spanning nine organisations across IT services, hospitality, telecommunications, retail and logistics.
The important caveat is that this is a seller's claim that a threat intelligence vendor has partially corroborated, not a set of confirmed breaches. TechNadu notes that none of the named companies had publicly confirmed the exposure at the time of publication. TCS went further, telling the NSE India that it had investigated and found no "credible evidence of a breach of TCS systems or customer environments," that the details in circulation appear to be at least four years old, and that they include only basic employee information. TCS also addressed the intrusion method directly, stating that "the attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector" and that the company has had strong safeguards against those techniques in place for more than two years. Accounts therefore genuinely differ: Hudson Rock reads the data as authentic Azure directory output, while the largest respondent among the alleged victims says the material is old and not the product of a current compromise. Both can be partly true if the dumps are recycled or aggregated from older exports.
What Was Taken
Total volume is reported consistently at 3.64 million records by Global Security Mag and BleepingComputer, with The Register, SecurityWeek, Help Net Security and IT Pro describing it in round terms as "millions." The per-victim breakdown is stable across sources for the largest datasets and thins out at the bottom of the list.
- McDonald's: more than 1.7 million records, cited by all reporting outlets
- Tata Consultancy Services: more than 800,000
- Vodafone: 425,000
- HCL Technologies: 250,000, per The Register, SecurityWeek and Help Net Security
- InterContinental Hotels Group: about 185,000, per SecurityWeek and TechNadu
- Kyndryl, Gap, Hexaware and Wyndham: Help Net Security places the remainder in a range from "several thousand to over 170,000 records apiece." TechNadu, an OTHER-tier source, gives specific figures of 170,000 for Kyndryl, 80,000 for Gap, 20,000 for Hexaware and 9,000 for Wyndham. Treat those four numbers as single-source until corroborated.
On field content, the sources converge. Hudson Rock told SecurityWeek that "across all the affected tenant dumps, the leaked fields consistently include foundational corporate directory attributes," alongside active domains and tenant-specific .onmicrosoft.com structures. The attributes reported include employee names, corporate email addresses, employee IDs, job titles, phone numbers, postal addresses, departments, office locations, manager and reporting structures, group memberships and service accounts.
The most consequential detail comes from The Register and SecurityWeek: some records reportedly identify accounts holding Global Administrator privileges. As Hudson Rock put it, "the exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations." No source reports that passwords or credential material are included in the dumps themselves.
Why It Matters
A directory export is not a headline-grabbing data class. There are no payment cards here, and in most cases no customer records despite some coverage framing it that way. What it is, is targeting infrastructure. A full Entra directory tells an attacker who reports to whom, which mailboxes belong to finance or IT operations, which accounts are service principals, and which humans hold tenant-wide administrative rights. That converts generic phishing into precisely aimed pretexting, and it converts a credential-stuffing spray into a shortlist.
The second-order risk is downstream. Four of the nine named organisations are IT services and outsourcing providers, meaning their employee directories map onto client engagements. Seemant Sehgal of BreachLock, quoted by Global Security Mag, framed the exposure as "the raw materials for follow-on attacks, targeted phishing, or supply chain access," and noted that "the organizations downstream from the initial compromise are often the ones who feel it most."
Third, this is a dwell-time story as much as an access story. Sehgal's sharper question for defenders: whether "a credential that was exposed six months ago is still giving someone access to a cloud environment today." Directory reads leave far fewer traces than data destruction or ransomware deployment, and a read-only identity enumeration by an account that legitimately holds directory permissions may generate no alert at all.
The Attack Technique
TheHatman's own claim, repeated in every listing, is that the data was pulled directly from the victims' Azure and Entra portals using compromised credentials. Beyond that, the record is openly unresolved. Hudson Rock stated plainly that "while the data is highly likely authentic, it is not conclusive how this campaign is being carried out," and that "the exact intrusion vector remains unknown." The vendor floated four possibilities: active infostealer infections capturing employee session tokens, successful phishing yielding administrative access, missing or weak MFA enforcement on specific tenant portals, and abuse of a third-party API or integration holding excessive permissions.
Hudson Rock's own leading hypothesis is infostealer-derived. Per SecurityWeek, the firm identified stolen credentials linked to most of the affected organisations in its infostealer datasets, and argued that the victimology itself points to deliberate targeting rather than opportunistic collection. TCS, meanwhile, attributes a different method to the attacker: password spraying combined with MFA fatigue, techniques it says it has defended against for more than two years.
Unit 42's threat brief places the incident in a broader pattern rather than validating the specifics. Its framing is that "identity has effectively become the new perimeter, where cybercriminals are increasingly choosing to log in rather than break in," with attackers harvesting previously leaked credential pairs and pivoting to password spraying against internet-exposed services. It lists the TheHatman activity alongside the June 2026 FortiBleed password-spraying campaign against Fortinet devices, and recommends auditing remote access logs with a focus on successful logins occurring shortly after high-volume authentication failure events.
What Organizations Should Do
- Hunt for bulk directory enumeration, not just failed logins. Review Entra ID audit and sign-in logs for large-volume reads of user, group and service principal objects, Graph API calls returning full directory pages, and any use of directory export tooling by accounts that do not normally perform it. Follow Unit 42's specific guidance and flag successful authentications that immediately follow bursts of failures, the classic password-spray success signature.
- Treat exposed Global Administrator and service accounts as compromised targets. If your tenant appears in this campaign, rotate credentials and secrets for every privileged and service identity, review consented application permissions, and confirm that break-glass accounts are excluded from any policy gaps.
- Close the MFA gaps that exist per-portal rather than per-tenant. Hudson Rock explicitly named "a lack of strict Multi-Factor Authentication on specific tenant portals" as a candidate vector. Enforce phishing-resistant MFA, and pair it with number matching to blunt the MFA-fatigue technique TCS says was claimed against it.
- Assume session tokens, not just passwords, are in play. Infostealer malware harvests cookies and refresh tokens that survive a password reset. Implement token protection and continuous access evaluation, shorten refresh token lifetimes for privileged roles, and revoke active sessions when rotating credentials.
- Audit third-party applications and integrations for excessive directory permissions. Any OAuth application holding Directory.Read.All or broader is a viable path to the exact dataset being sold here. Remove stale consents and enforce admin consent workflows for new grants.
- Monitor infostealer telemetry for your own domains. Hudson Rock's finding that stolen credentials tied to most named organisations were already present in infostealer datasets is the practical lesson: subscribe to or query credential-exposure feeds continuously, and treat a hit on a corporate email as an incident trigger rather than a routine reset.
- Brief staff for the follow-on phishing wave. A leaked directory enables convincing internal pretexting that names real managers and real reporting lines. Warn high-value roles specifically, and confirm out-of-band verification procedures for payment and access requests.
Sources: Hacker claims 3.6 million records stolen from major companies' Azur... | Threat Brief: Mitigating Large-Scale Credential Attacks (Updated Au... | Hacker claims 3.6 million Azure account records stolen ... | Crook hawks millions of records allegedly plundered from corporate... | Fortune 500 Companies Hit in Azure Data Theft Campaign | Hacker claims millions of records stolen from corporate ... | TheHatman Azure Exfiltration Hits McDonald's, TCS, Vodafone, Kyndry... | Hacker claims to have stolen millions of Azure customer ...