Summary
- A threat actor named ‘TheHatman’ is selling what are claimed to be millions of employee records from nine major organisations including McDonald’s, Vodafone, Tata Consultancy Services, and Kyndryl.
- Hudson Rock assessed the data as ‘highly likely authentic,’ noting corporate email structures consistent with Microsoft Azure directory exports.
- Records reportedly include phone numbers, physical addresses, employee IDs, job titles, reporting structures, and — critically — accounts holding Global Administrator privileges.
- The initial access vector is unconfirmed; possibilities raised include infostealer-stolen credentials, phishing, MFA absence or fatigue, and overly permissive third-party applications.
- TCS has publicly stated it found no credible evidence of a breach and that any exposed information appears to be more than four years old and limited to basic employee data.
What is being claimed
A threat actor using the handle ‘TheHatman’ is advertising for sale what are alleged to be millions of employee records harvested from the Microsoft Azure environments of nine large enterprises. The list of named organisations includes McDonald’s (1.7 million records), Tata Consultancy Services (800,000), Vodafone (425,000), HCL Technologies (250,000), IHG Hotels & Resorts, Kyndryl, Gap, Hexaware Technologies, and Wyndham Hotels & Resorts. The claims were first published by security research firm Hudson Rock.
What the data reportedly contains
This is not a simple credential dump. Samples reviewed by Hudson Rock reportedly include phone numbers, physical addresses, employee IDs, job titles, departments, office locations, organisational reporting structures, group memberships, and service account details. Some records also reportedly identify accounts carrying Global Administrator privileges. For a threat actor planning a targeted phishing or business email compromise campaign, that last detail amounts to a ready-made shortlist of high-value individuals to approach.
How authentic is the data?
Hudson Rock described the dataset as ‘highly likely authentic,’ pointing to corporate email address formats and data structures consistent with exports from Microsoft Azure directory services. The firm also noted that its own infostealer database contained compromised Microsoft cloud credentials associated with most of the named organisations, though it could not directly link those credentials to TheHatman’s alleged access. Authenticity of advertised breach data is always uncertain until organisations confirm or deny it, and that confirmation has not arrived from most of the named parties.
The access vector remains unknown
How the data allegedly left nine separate corporate environments is the central unanswered question. TheHatman claims to have used compromised credentials, but Hudson Rock was unable to independently establish the initial access method. The firm floated several candidate vectors: credentials or session cookies stolen by infostealer malware, phishing campaigns, weak or absent multifactor authentication, and overly permissive third-party applications connected to Azure tenants. Hudson Rock leaned toward infostealer infections as the most probable explanation, reasoning that a systemic zero-day in Azure would likely have produced a far broader and more diverse victim pool, including smaller organisations.
TCS responds; others remain silent
Of the nine named organisations, Tata Consultancy Services provided the most substantive public response, filing a statement with India’s stock exchange. TCS said it had investigated the matter and found no credible evidence of a breach of its systems or customer environments. The company stated the information in question appears to be more than four years old and limited to basic employee information, and that customer data and operational systems are unaffected. TCS also addressed the attacker’s specific claim of password spraying and MFA fatigue as the access method, noting it has had controls against those techniques in place for more than two years. The Register reached out to all named organisations and to Microsoft; as of publication, the other parties had not responded.
Why it matters
For CISOs, this incident illustrates a risk that sits beneath the threshold of a traditional breach: the systematic harvesting of directory data from Azure or Entra ID environments. Even without passwords, a detailed organisational chart that identifies Global Administrators, reporting lines, group memberships, and service accounts is a substantial intelligence asset for adversaries. It enables precision phishing, privilege escalation targeting, and social engineering at a level of specificity that generic credential dumps do not support. The unconfirmed but plausible role of infostealer malware is a further concern — it suggests the exposure may have originated outside the perimeter, through compromised employee devices, before ever touching the Azure tenant directly. Organisations that have not audited third-party application permissions, reviewed conditional access policies, or assessed their infostealer exposure should treat this as a prompt to do so.
What to do now
- Audit Microsoft Entra ID (formerly Azure AD) for overly permissive third-party application consents and revoke any that are unnecessary or unrecognised.
- Review which accounts hold Global Administrator or other privileged roles, and ensure those accounts are protected by phishing-resistant MFA rather than push-notification-based methods susceptible to fatigue attacks.
- Check your organisation’s exposure in infostealer logs — commercial threat intelligence services maintain databases of compromised credentials that can be queried against your domains.
- Enforce conditional access policies that restrict access based on device compliance, location, and risk signals, reducing the value of stolen credentials or session cookies.
- If your organisation is among those named, verify with your Azure tenant logs whether any unusual bulk directory queries or exports occurred, and consider whether a formal incident review is warranted regardless of whether a breach is confirmed.
