Back Feeds.4Sysops

Azure credential theft puts 3.6 million enterprise directory records up for sale

Feeds.4Sysops •IT News • August 17, 2026

A threat actor known as TheHatman is advertising roughly 3.6 million employee directory records allegedly stolen from nine Microsoft Azure and Entra ID tenants, including McDonald’s, Tata Consultancy Services, Vodafone, and Kyndryl. Samples appear highly likely to be genuine and reportedly include organizational data that could help attackers identify privileged accounts and target follow-on phishing campaigns. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Azure Data Breach Exposes 3.6 Million Employee Records from Major Corporations A threat actor known as 'TheHatman' has claimed responsibility for a significant data breach involving employee directories from nine major companies, including McDonald's, Vodafone, and Tata Consultancy Services (TCS). The attacker is selling approximately 3.6 million records, which were allegedly extracted from Microsoft Azure and Entra environments using compromised credentials. The leaked data includes sensitive information such as employee names, email addresses, phone numbers, job titles, and organizational structures. Cybersecurity firm Hudson Rock has assessed the data as likely authentic, although the exact method of access remains unclear. Potential attack vectors include infostealer malware, phishing, and weak multi-factor authentication practices. Affected companies have not confirmed the breach, with some stating that the data appears outdated. The incident raises concerns about the risks of social engineering and targeted phishing attacks against employees. 30 sources 67

Extracted Entities

Azure credential theft puts 3.6 million enterprise directory records up for sale

The full story

Extracted Entities

Attack Types (1)

Companies (5)

MITRE ATT&CK (1)

Platforms (1)