Hacker claims millions of records stolen from corporate Azure tenants

1. Executive summary

A threat actor using the alias "TheHatman" claims to have exfiltrated millions of employee records from the Microsoft Azure tenants of at least nine Fortune 500 companies, including McDonald's (1.7M records), TCS (800K), Vodafone (425K), and HCL Technologies (250K). Hudson Rock assessed the leaked data samples as "highly likely authentic," noting field structures consistent with Azure directory exports containing employee IDs, job titles, reporting structures, group memberships, service accounts, and Global Administrator account names. The initial access vector is unconfirmed; Hudson Rock assesses with moderate confidence that infostealer-compromised credentials or session tokens are the likely root cause rather than a systemic Azure vulnerability. Attribution to "TheHatman" is unconfirmed — the actor has no MITRE ATT&CK profile. EMEA financial services clients with Azure/Entra ID tenants should treat this as a credential-hygiene and directory-export-exposure event, not a Microsoft platform zero-day.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged beyond standard incident-response obligations, as no confirmed breach of a regulated EMEA entity has been established.

3. Technical analysis & attack chain

Attribution caveat: "TheHatman" has no MITRE ATT&CK profile. Attribution is unconfirmed and rests on Hudson Rock's reporting and cybercrime forum posts. Treat all actor-level claims as single-sourced.

Confirmed facts

1. Over the past week (prior to 2026-08-18), a threat actor posting as "TheHatman" advertised large employee directory datasets on cybercrime forums, claiming each was pulled directly from victim Azure tenants.
2. Nine organisations are named: McDonald's, Vodafone, Kyndryl, TCS, HCL Technologies, IHG Hotels & Resorts, Gap Inc., Hexaware Technologies, and Wyndham Hotels & Resorts.
3. Hudson Rock examined sample data and found corporate email addresses and field names consistent with standard Azure directory exports. The data is assessed as "highly likely authentic" but the intrusion vector is "not conclusive."
4. Leaked fields include: employee IDs, job titles, departments, manager and direct-report information, group memberships, service account details, office locations, phone numbers, physical addresses, and in some cases the names of accounts holding Global Administrator privileges.
5. Hudson Rock's infostealer database contains compromised Microsoft cloud credentials associated with most of the named companies, but could not definitively link those credentials to TheHatman's access.

Attack vector — unconfirmed, multiple hypotheses from Hudson Rock

Hudson Rock floated four possible vectors, none independently confirmed:

• Infostealer-compromised session tokens or credentials — assessed as "highly likely" the primary cause, given the concentration on large enterprises rather than a broad spectrum of organisations (which would indicate a platform vulnerability). Hudson Rock specifically noted that infostealer infections compromising employee session tokens could enable directory data exfiltration via automated export.
• Phishing campaigns yielding administrative access — not corroborated by specific phishing artefacts in the source material.
• Weak or absent MFA on specific tenant portals — not corroborated by specific MFA-bypass artefacts.
• Third-party API/integration abuse with excessive read privileges — not corroborated by specific application identifiers.

TCS counter-claim: TCS filed a statement with the Bombay Stock Exchange on 2026-08-10 stating it "has not found any credible evidence of a breach of TCS systems or customer environments." TCS reported the referenced data appears to be more than four years old and limited to basic employee information. TCS attributed the attacker's claimed vector as "password spray and Multi-Factor Authentication (MFA) fatigue" and stated it has had safeguards against such techniques for more than two years. This is a single-source vendor statement; the data age claim has not been independently verified.

Why the data matters: The exposure of service account names and Global Administrator account identities provides a direct roadmap for targeted spear-phishing, social engineering, or privilege escalation. Even without passwords, the organisational chart data (reporting structures, group memberships) enables highly credible business email compromise (BEC) pretexts.

4. Mitigation & containment

P1 — within 24 hours

• Query infostealer monitoring feeds (Hudson Rock, or equivalent credential-monitoring service) for any Azure/Entra ID credentials or session tokens associated with your tenant domains. Treat any hits as compromised and force password resets + token revocation for affected accounts.
• Review Entra ID sign-in logs for anomalous directory export activity: look for AuditLogs entries with activityDisplayName = "Export directory" or bulk download operations, particularly from unfamiliar IPs or non-interactive sign-ins.
• Revoke all active refresh tokens for accounts identified in infostealer corpora: Revoke-AzureADUserAllRefreshToken -ObjectId <user> or via Microsoft Graph POST /users/{id}/revokeSignInSessions.

P2 — within 72 hours

• Audit all third-party application registrations and OAuth grants in Entra ID. Identify any application with Directory.Read.All or Directory.ReadWrite.All Microsoft Graph permissions. Remove or restrict grants that are unused, overly broad, or from unverified publishers.
• Enforce Conditional Access policies requiring MFA for all Azure management portal access and Microsoft Graph directory access. Block legacy authentication protocols (POP, IMAP, SMTP, EWS) if not already blocked.
• Review Global Administrator role assignments. Reduce to minimum required. Enable Privileged Identity Management (PIM) for just-in-time elevation if not already deployed.
• Identify service accounts in the directory and ensure they are excluded from interactive sign-in where possible, and that any with directory-read access are scoped to the minimum required.

P3 — within 7 days

• Conduct a retrospective review of Entra ID audit logs (last 90 days minimum) for bulk directory export events, unusual Graph API query patterns (/users, /groups, /servicePrincipals with large result sets), and sign-ins from infostealer-correlated IP addresses.
• Validate that session token lifetimes are configured to organisational policy and consider shortening refresh token lifetimes for privileged accounts.
• Brief phishing-response teams on the specific exposure: attacker knowledge of reporting structures, group memberships, and Global Admin identities enables highly targeted social engineering. Update BEC detection rules to flag internal-spoof patterns referencing newly exposed organisational relationships.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file artefacts) are present in the source material. The sources describe observable behaviours but no machine-pivotable IOCs.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The sources contain no file hashes, distinctive command-line strings, mutex names, or network artefacts attributable to the threat itself. The behavioural indicators above should be implemented as Entra ID audit log queries and Conditional Access alerting rather than YARA/Sigma rules.

7. Sources

• Help Net Security — "Hacker claims millions of records stolen from corporate Azure tenants" — https://www.helpnetsecurity.com/2026/08/18/azure-data-leak-fortune-500-companies/ — 2026-08-18
• The Register — "Crook hawks millions of records allegedly plundered from corporate Azure tenants" — https://www.theregister.com/security/2026/08/17/crook-hawks-millions-of-records-allegedly-plundered-from-corporate-azure-tenants/5288305 — 2026-08-17

8. Adverse Trace position

This is a credential-hygiene and directory-data-exposure event, not a Microsoft platform vulnerability. The data is assessed as likely authentic by Hudson Rock (single-sourced; verify before enforcement), but the intrusion vector remains unconfirmed across all nine victims. The operational risk to EMEA financial services is twofold: (1) if your tenant credentials appear in infostealer corpora, your directory is potentially exfiltrable using the same pattern; (2) if your organisation has business relationships with any of the nine named entities, the exposed organisational charts and admin identities can be weaponised for targeted BEC and social engineering against your staff. We are treating this as a medium-severity advisory — no confirmed zero-day, no confirmed ongoing active exploitation of a vulnerability, but credible data exposure with actionable defensive steps. We will monitor for confirmation of the intrusion vector, additional victim disclosures, and any emergence of atomic IOCs tied to TheHatman's infrastructure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.