started · updated
McDonald's and Vodafone among firms hit by massive Azure credential theft campaign
A threat actor known as 'TheHatman' is advertising the sale of approximately 3.64 million stolen employee records on the dark web. The data is allegedly exfiltrated from the Microsoft Azure and Entra ID tenants of several Fortune 500 companies.
Major organizations reportedly impacted include McDonald’s, with over 1.7 million records, Tata Consultancy Services (TCS) with 800,000, Vodafone with 425,000, and HCL Technologies with 250,000. Other named entities include InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels.
Security researchers from Hudson Rock have assessed the datasets as 'highly credible,' noting that the structure of the data aligns with standard Azure directory exports. The stolen information includes full names, corporate email addresses, employee IDs, job titles, and organizational hierarchies. Most critically, the leaks reportedly contain access and group mapping data, including service accounts and Global Administrator records, which could facilitate advanced spear-phishing and privilege escalation attacks.
Investigators suggest the breach likely resulted from compromised credentials obtained via infostealer malware rather than a zero-day exploit. While some companies, such as TCS, have challenged the claims by stating they found no evidence of a breach and suggesting the data may be outdated, the scale of the alleged exposure remains a significant concern for enterprise security.
Entities
McDonald's · McDonald's Corporation · Microsoft · Microsoft Azure · Tata Consultancy Services · TheHatman · Vodafone
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 7 SOURCES] McDonald’s is among the victims, with over 1.7 million records allegedly exposed. cybersecuritynews.com · flagthis.com · 4sysops.com · www.ad-hoc-news.de · borncity.com · +2 more
- [○ 1 SOURCE] Tata Consultancy Services stated its investigation found no credible evidence of a breach and suggested the data might be at least four years old. 4sysops.com
- [● 7 SOURCES] Vodafone is listed with approximately 425,000 records. cybersecuritynews.com · flagthis.com · 4sysops.com · www.ad-hoc-news.de · borncity.com · +2 more
- [● 5 SOURCES] Researchers at Hudson Rock assessed the leaked datasets as highly credible due to their alignment with standard Azure directory exports. cybersecuritynews.com · 4sysops.com · www.it-daily.net · borncity.com · www.theregister.com
- [● 2 SOURCES] The attacker claims to have stolen approximately 3.64 million employee records. 4sysops.com · borncity.com
- [● 7 SOURCES] A threat actor using the alias 'TheHatman' is selling stolen employee records from Microsoft Azure and Entra tenants. cybersecuritynews.com · flagthis.com · 4sysops.com · www.ad-hoc-news.de · borncity.com · +2 more
- [● 5 SOURCES] The stolen data includes sensitive information such as Global Administrator accounts and service account details. cybersecuritynews.com · flagthis.com · 4sysops.com · www.it-daily.net · www.theregister.com
- [● 7 SOURCES] Tata Consultancy Services (TCS) is listed with approximately 800,000 records. cybersecuritynews.com · flagthis.com · 4sysops.com · www.ad-hoc-news.de · borncity.com · +2 more