A threat actor known as TheHatman is advertising millions of employee records that it claims were pulled from the Azure environments of nine large companies, according to Hudson Rock.
Nine employers appear on the alleged victim list, from fast food to IT services. McDonald’s tops the claimed haul at roughly 1.7 million records, with Tata Consultancy Services (TCS) at about 800,000 and Vodafone at 425,000, while Gap, Wyndham Hotels, Kyndryl, HCL Technologies, Hexaware Technologies, and InterContinental Hotels Group round out the rest.
Hudson Rock examined samples and found corporate email addresses and field names consistent with a standard Azure directory export, indicating the data is likely authentic. Each dump carries employee IDs, job titles, departments, reporting lines, group memberships, and service accounts. Some even name accounts holding Global Administrator privileges.
Researchers said the exact intrusion vector is unknown, but they believe compromised infostealer session tokens, phishing, and MFA gaps are more plausible than a systemic Azure flaw. That scale and pace points to a systematic, automated operation that kicks in once attackers have a foothold, the researchers added.
TCS filed a statement with the Bombay Stock Exchange saying it found no credible evidence of a breach of its own systems. The company said the referenced information appears more than four years old and is limited to basic employee details.
The exposure of service-account and global admin names gives attackers a roadmap for spear-phishing and privilege escalation, Hudson Rock warned. Organizations should assume tenant directory exports are sensitive and monitor for bulk enumeration.
