Azure Credential Theft Exposes Millions of Corporate Records

A hacker operating under the alias TheHatman is publicly advertising millions of employee records allegedly stolen from the cloud environments of several major global corporations, including McDonald’s, Vodafone, and Tata Consultancy Services. Security researchers have assessed the data as highly likely to be authentic, raising significant concerns about potential follow-on cyberattacks targeting the affected organizations.

The dataset, offered on cybercrime forums over the past week and totaling approximately 3.6 million records, purportedly came from the Microsoft Azure and Entra ID tenants of nine companies. Besides the firms named above, the list includes HCL Technologies, Kyndryl, InterContinental Hotels Group, Gap Inc., Hexaware Technologies, and Wyndham Hotels. According to analyses by security firm Hudson Rock, the information appears legitimate, with corporate email addresses and field names matching standard Azure directory exports. The largest alleged dumps are for McDonald’s, with about 1.7 million records, followed by TCS with roughly 800,000, Vodafone with 425,000, and HCL Technologies with 250,000.

The compromised data reportedly contains detailed internal...