Hacker claims millions of records stolen from corporate Azure tenants
Threat actor TheHatman claims millions of employee records stolen from Azure tenants of nine Fortune 500 firms, including McDonald's, Vodafone, Kyndryl, and TCS.
A threat actor known as TheHatman posted large internal employee directories on cybercrime forums over the past week, claiming each was pulled directly from the victim organization's Azure tenant. McDonald's tops the list at roughly 1.7 million records, followed by TCS (~800,000), Vodafone (~425,000), and HCL (~250,000), with IHG, Kyndryl, Gap, Hexaware, and Wyndham also named. Hudson Rock found samples consistent with standard Azure directory exports and suspects infostealer-derived credentials rather than a systemic Azure zero-day. TCS filed a statement with the Bombay Stock Exchange saying it found no credible evidence of a breach and the data appears over four years old.
- Dumps include service accounts and Global Administrator names, enabling follow-on phishing and escalation
- Suspected vectors include infostealer session tokens, phishing, password spraying, and MFA fatigue
- TCS says no credible breach evidence; referenced data appears more than four years old
- Hudson Rock judges the leaked samples likely authentic but the intrusion vector unconfirmed
- ATT&CK
- T1555 Credentials from Password StoresT1566 PhishingT1110.003 Password SprayingT1621 Multi-Factor Authentication Request Generation
- Vendors
- Microsoft
- Products
- Microsoft Azure
- Threat actors
- TheHatman
- Victims
- McDonald'sTata Consultancy ServicesVodafoneHCL TechnologiesInterContinental Hotels GroupKyndrylGapHexaware TechnologiesWyndham Hotels
- Organizations
- Hudson Rock
From the original article
3 min read at helpnetsecurity.com
A threat actor known as “TheHatman” claims to have obtained millions of employee records from the Azure environments of several Fortune 500 companies, including McDonald’s, Vodafone, Kyndryl, and Tata Consultancy Services (TCS), according to Hudson Rock.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.