Hacker "TheHatman" claims millions of Azure records stolen from McDonald's, Vodafone and others

Full text

Hacker “TheHatman” claims to have stolen millions of Azure/Entra employee records from major firms

Data includes names, emails, job titles, privileged accounts; risks include impersonation and fraud

Victims dispute scope, but researchers say infostealer‑based theft makes the leaks likely authentic

A cybercriminal is selling millions of user records on the dark web, which they claim to have stolen from large organizations such as McDonalds, Tata Consultancy Services, and Wyndham Hotels.

A hacker going by the alias “TheHatman” posted multiple threads on dark web forums, claiming to have stolen information from Azure and Entra environments.

TheHatman said they broke in using compromised login credentials, targeting almost a dozen organizations.

What was stolen and from whom?

Among the victims and the number of records exposed, are:

McDonald’s Corporation: 1,700,000 records

TCS (Tata Consultancy Services): 800,000 records

Vodafone: 425,000 records

HCL Technologies: 250,000 records

InterContinental Hotels Group (IHG): 185,000 records

Kyndryl: 170,000 records

Gap Inc.: 80,000 records

Hexaware Technologies: 20,000 records

Wyndham Hotels: 9,000 records

They are now looking for a buyer: “I’m selling McDonald’s Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials,” TheHatman said in one of the posts.

In their writeup, security researchers from Cybernews said they analyzed one of the samples posted on the dark web and said the entries were “consistent with Azure directory exports”.

They contained employee names, emails, phone numbers, job titles, workplace addresses, IDs, the departments they work in, user group memberships, service accounts, and highly privileged account records.

What are the risks?

Stealing information such as names, email addresses, and workplace details might not sound like a worrisome breach of privacy, but the implications are rather big. Cybercriminals can use it to impersonate a business partner or a major client, and try to trick their employees into installing ransomware , or making a fraudulent wire transaction. That way, they can escalate what seems like a relatively benign breach, into a full-blown cyberattack with material and legal consequences.

For example, a criminal might discover a Vodafone employee that regularly handles payments to a particular supplier. They might impersonate that supplier’s finance director, engage in conversation and, while requesting a new payment, warn that the company changed their bank account. This is not a purely theoretical scenario - it’s been documented time and time again.

What did the victims say?

Most organizations are yet to give an official statement about these claims. Gap told BleepingComputer that it found no evidence of the breach and suggested that the attackers merely repackaged data from an older incident.

“Our preliminary investigation indicates that the data in question is limited in scope, non-sensitive and dated back to several years ago. Notably, there is no evidence to suggest that our corporate systems have been compromised,” Gap told the publication.

Tata Consultancy Services notified the Indian National Stock Exchange about the breach last week, also suggesting that this was a resurfacing of an older incident.

“The Company has investigated the matter and has not found any credible evidence of a breach of TCS systems or customer environments,” TCS said in the filing. “The information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS operational systems have been impacted.”

TCS said the attackers broke in using credential stuffing, something that could have only been done years ago: “The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. The Company has had strong safeguards in place against such techniques for more than two years.”

Not everyone agrees with that assessment, though. Security researchers Hudson Rock believe the attackers stole login credentials with an infostealer , rather than through password spraying.

“Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure,” the researchers said in their report. “If this were a widespread vulnerability, we would likely see a much broader spectrum of organizations impacted, including smaller businesses, rather than just these massive Fortune 500-level enterprises.”

Hudson Rock also described the stolen data as “likely highly authentic”, hinting that just because it’s older, it doesn’t mean it’s not useful.