McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen
A seller offers 1.7 million McDonald's employee records allegedly taken from its Azure tenant via compromised credentials; an 8,000-row sample verifies as genuine.
A forum seller named TheHatman posted an 8,000-row sample of McDonald's employee directory data, claiming a 1.7 million-record haul pulled directly from the company's Azure tenant using compromised credentials. Ransomnews analysis found authentic Entra ID export artifacts, including genuine domains, tenant-internal addresses, encoding errors, and truncated HR fields, but could not verify the data's age or the 1.7 million figure. The same seller listed nine datasets in 16 days covering about 3.6 million records across McDonald's, Vodafone, Gap, hotels, and IT outsourcers, suggesting infostealer-driven credential resale. No passwords or hashes appear in the sample, so the primary risk is social engineering.
- Column names match Microsoft PowerShell Entra ID export properties exactly.
- Mangled UTF-8 encoding and 30-character truncated titles indicate genuine export errors.
- Same seller posted nine listings totaling about 3.6 million records in 16 days.
- No passwords or hashes leaked; exposure enables helpdesk and invoice social engineering.
- Vendors
- Microsoft
- Victims
- McDonald's
From the original article
4 min read at securityaffairs.com
A seller claims 1. 7M McDonald’s employee records were stolen from Azure. An 8,000-row sample appears genuine, but its age and full size remain unconfirmed.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.