Azure data theft exposes employee records at Fortune 500 firms

A threat actor using the name ‘TheHatman’ is offering millions of employee records it says were taken from Azure/Entra tenants of several Fortune 500 companies, including McDonald’s, Tata Consultancy Services and Vodafone.

Security firm Hudson Rock examined the listings and reported the largest dataset contains more than 1.7 million McDonald’s records. Other dumps include about 800,000 records tied to TCS, 425,000 for Vodafone, 250,000 for HCL Technologies and 185,000 for InterContinental Hotels Group. Additional datasets are listed for Kyndryl, Gap Inc., Hexaware Technologies and Wyndham Hotels.

The exposed files match the format and field names of Azure directory exports. They include employee names, corporate email addresses, home addresses, phone numbers, employee IDs, job titles and manager relationships. The dumps also list user group membership, service account names and records for highly privileged accounts.

Hudson Rock’s analysis attributes the extraction to leaked credentials tied to a targeted infostealer campaign. The firm found those credentials allowed the actor to export directory data from cloud tenants without breaching corporate networks directly.

Hudson Rock noted, “The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations.”

The firm also reported the victim list spans IT services, hospitality, telecommunications, retail and logistics, and that compromised credentials appear linked to the affected organizations, characterizing the activity as a targeted campaign.

Azure tenants are the identity and resource containers companies use to manage cloud accounts and access; Entra is Microsoft’s identity platform. When credentials with permissions to export directory data are leaked or harvested by malware, attackers can extract records en masse from cloud tenants.

Hudson Rock recommended resetting compromised credentials, auditing global admin and service account activity, enforcing multifactor authentication and reviewing logs for suspicious exports or account usage.