McDonald's, TCS and Vodafone: TheHatman Azure Tenant Data Sale

A threat actor using the alias TheHatman is advertising employee directory dumps allegedly pulled from the Microsoft Azure and Entra ID tenants of nine major enterprises, with a claimed total of 3.64 million records across all listings. BleepingComputer, The Register, SecurityWeek and Help Net Security all report the same 3.64 million figure, sourced from research published by Hudson Rock, which assessed the samples as "highly likely authentic" based on corporate email addresses and field names consistent with standard Azure directory exports. Palo Alto Networks Unit 42, in a threat brief updated 18 August 2026, has added the activity to its tracking of large-scale credential attacks, describing it as an actor claiming to have stolen a large volume of credentials from organizations' Microsoft Entra tenants. Two named victims, Tata Consultancy Services and Gap Inc., have publicly rejected the breach claims. The remaining seven have not commented. Nothing here is a confirmed compromise of Microsoft's platform, and the seller himself says so.

What Happened

Beginning 31 July 2026, TheHatman posted a run of listings to cybercrime forums, including DarkForum, each advertising an internal employee directory said to have been downloaded straight from the victim's Azure tenant. The largest and most recent, posted Sunday 16 August, claims 1.7 million employee records from McDonald's Corporation. The advertisement reads: "I'm selling McDonald's Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials."

The nine claimed victims and their advertised record counts, consistent across BleepingComputer, The Register, SecurityWeek, Help Net Security and TechNadu:

• McDonald's Corporation: over 1.7 million
• Tata Consultancy Services: over 800,000
• Vodafone: over 425,000
• HCL Technologies: over 250,000
• InterContinental Hotels Group: over 185,000
• Kyndryl: 170,000 (Help Net Security says "over 170,000"; TechNadu lists a flat 170,000)
• Gap Inc.: over 80,000
• Hexaware Technologies: over 20,000
• Wyndham Hotels: over 9,000

The figures are the seller's own, not independently counted. Coverage of the sectoral spread also differs slightly: SecurityWeek and Help Net Security describe IT services, hospitality, telecoms and retail, while TechNadu adds logistics to that list.

Accounts diverge on what the victims have said. TechNadu, publishing Sunday, states that none of the named companies had publicly confirmed the exposure. By 17 and 18 August, BleepingComputer and eBuilder Security reported that TCS had notified the National Stock Exchange of India that it found no "credible evidence of a breach of TCS systems or customer environments," that the details appear to be at least four years old and limited to basic employee information, and that it has had strong safeguards against password spraying and MFA fatigue in place for more than two years. TCS added that a review found those defences still effective. eBuilder Security separately reports a Gap Inc. spokesperson giving a similar account: no evidence of a breach, data limited in scope, not sensitive and several years old. That Gap statement appears in only one OTHER-tier source and should be treated as single-sourced. The remaining seven organisations had not responded at the time of publication.

There is also a framing discrepancy worth flagging. IT Pro's headline describes the material as "Azure customer records," while its own body text, and every other source, describes internal employee and directory data. Treat this as employee data.

What Was Taken

If the samples are genuine, the exposure is a corporate identity graph rather than a consumer data dump. The listings and Hudson Rock's sample review point to a consistent set of Entra ID directory attributes:

• Full names, employee IDs and corporate email addresses
• Job titles, departments, office locations and reporting structures
• Phone numbers and postal addresses
• Security and distribution group memberships
• Service accounts and other non-human tenant account records

The Register and SecurityWeek both report the most consequential element: some records reportedly identify accounts holding Global Administrator privileges. eBuilder Security notes the Kyndryl dump in particular includes service accounts and other tenant account records. Hudson Rock's assessment, as quoted by SecurityWeek, is that "the exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks."

No source claims passwords, hashes or authentication secrets are in the dumps. TheHatman has provided a sample database for each company so buyers can verify before paying, which is standard practice and also the reason researchers were able to review the data at all.

Why It Matters

Directory exports are frequently dismissed as low-severity because they contain no credentials or financial data. That reading undersells them. A complete Entra tenant export tells an attacker who reports to whom, which accounts are service principals, which humans hold Global Administrator, and what the organisation's email naming convention is. That is precisely the reconnaissance an operator would otherwise spend weeks assembling before a business email compromise or a help-desk social engineering call.

The strategic point Unit 42 makes in its threat brief is the wider frame here: identity has become the perimeter, and attackers are "increasingly choosing to log in rather than break in." Unit 42 lists TheHatman alongside the June 2026 FortiBleed password spraying campaign against Fortinet devices as instances of the same pattern, harvesting leaked credential pairs and pivoting into internet-exposed services.

The TCS response also illustrates a real limitation in assessing this class of incident. A directory export that is four years stale is genuinely lower-risk, since many of those accounts will have been deprovisioned. But org structure, naming conventions and long-lived service accounts age slowly, and a denial that a breach occurred is not the same as a demonstration that the data is fabricated. Both things can be true: no current intrusion, and a usable old export in circulation.

The Attack Technique

TheHatman's own claim, repeated verbatim in the listings, is compromised credentials rather than any flaw in Azure or Entra ID. No source disputes that framing, and no vendor advisory in this set describes a platform vulnerability.

Beyond that, the picture is unresolved and the sources are explicit about it. Hudson Rock told Help Net Security: "While the data is highly likely authentic, it is not conclusive how this campaign is being carried out." The Register reports that Hudson Rock could not independently establish the initial access vector, and floated several possibilities: credentials or session cookies stolen by infostealer malware, phishing, weak or absent multi-factor authentication, and overly permissive third-party applications or integrations.

SecurityWeek and TechNadu report Hudson Rock leaning toward a targeted infostealer campaign as the likely source, noting that the firm identified stolen credentials linked to most of the affected organisations and that the victimology itself suggests targeting rather than opportunism. TechNadu is direct that the exact vector remains unconfirmed.

TCS, notably, characterises the claimed vector differently again, stating that the attacker claims to have used password spraying and MFA fatigue. That specific technique attribution comes from TCS's own filing as relayed by BleepingComputer and eBuilder Security, and is not corroborated by the researcher reporting. Unit 42's brief places the activity in its password spraying and credential-attack collection, which is consistent with, though not confirmation of, that account.

What Organizations Should Do

1. Hunt for spray-then-success patterns in sign-in logs. Unit 42's specific recommendation is to audit remote access and authentication logs for successful logins occurring shortly after high-volume password failure events. Extend this to Entra ID sign-in logs and cover the 31 July onward window.

2. Audit directory export and bulk-read activity. Review Entra ID audit logs and Graph API telemetry for large directory reads, unusual bulk user exports, and any application or service principal enumerating the full user object set. This is the actual detection opportunity for the behaviour described.

3. Inventory and constrain Global Administrator and service accounts. If admin identities are exposed, those accounts become the phishing target list. Enforce phishing-resistant MFA on all privileged roles, move to Privileged Identity Management with just-in-time elevation, and rotate credentials for service accounts that cannot take MFA.

4. Close the third-party application gap. Enumerate OAuth applications and enterprise app consents with directory read permissions, revoke anything unused or over-permissioned, and disable user consent for applications requesting elevated Graph scopes.

5. Address session token theft, not just passwords. Infostealer-harvested session cookies bypass MFA entirely. Deploy token protection and conditional access policies binding sessions to compliant, managed devices, and monitor for stolen corporate credentials appearing in infostealer logs.

6. Brief the help desk and finance teams. Exposed reporting structures and job titles make targeted pretexting materially easier. Require out-of-band verification for password and MFA reset requests, and for any payment or payroll change originating from an internal-looking request.

7. Treat non-response as an open question, not an all clear. Seven of the nine named organisations have said nothing publicly. If you are a customer, partner or supplier to any of them, ask directly rather than inferring from silence.

Sources: Hacker Sells 3.6 Million Employee Records From Nine ... | Threat Brief: Mitigating Large-Scale Credential Attacks (Updated Au... | Hacker claims 3.6 million Azure account records stolen ... | Crook hawks millions of records allegedly plundered from corporate... | Fortune 500 Companies Hit in Azure Data Theft Campaign | Hacker claims millions of records stolen from corporate ... | Hacker claims to have stolen millions of Azure customer ... | TheHatman Azure Exfiltration Hits McDonald's, TCS, Vodafone, Kyndry...