Massive Azure Data Breach Exposes 3.6 Million Employee Records from Major Corporations

A threat actor known as 'TheHatman' has claimed responsibility for a significant data breach involving employee directories from nine major companies, including McDonald's, Vodafone, and Tata Consultancy Services (TCS). The attacker is selling approximately 3.6 million records, which were allegedly extracted from Microsoft Azure and Entra environments using compromised credentials. The leaked data includes sensitive information such as employee names, email addresses, phone numbers, job titles, and organizational structures. Cybersecurity firm Hudson Rock has assessed the data as likely authentic, although the exact method of access remains unclear. Potential attack vectors include infostealer malware, phishing, and weak multi-factor authentication practices. Affected companies have not confirmed the breach, with some stating that the data appears outdated. The incident raises concerns about the risks of social engineering and targeted phishing attacks against employees.

Key Points: • TheHatman claims to have stolen 3.6 million records from Azure environments of major companies. • Leaked data includes sensitive employee information, which can facilitate targeted phishing attacks. • Affected organizations, including TCS and Gap, have denied any evidence of a breach.