Millions of Records Allegedly Stolen From Azure Tenants at McDonald's, Vodafone, TCS, Kyndryl

A cybercriminal using the handle "TheHatman" is advertising millions of employee records for sale that were allegedly siphoned from the Microsoft Azure environments of nine large companies, among them McDonald's, Vodafone, Tata Consultancy Services (TCS), and Kyndryl. The listings, detailed by threat-intelligence firm Hudson Rock and reported by The Register and SecurityWeek on August 17, 2026, describe the data as corporate directory exports pulled from Azure and Entra using compromised credentials. None of the named brands has confirmed a breach, and one, TCS, has publicly disputed it.

The alleged haul is large and specific. Based on Hudson Rock's review of the listings, the McDonald's dataset is the biggest at more than 1.7 million records, followed by roughly 800,000 from TCS, 425,000 from Vodafone, 250,000 from HCL Technologies, and 185,000 from InterContinental Hotels Group, with Kyndryl (about 170,000), Gap Inc., Hexaware Technologies, and Wyndham Hotels rounding out the nine organizations. That is the liftable claim: one seller, nine Fortune 500-scale directories, millions of employee records offered at once. It is also, for now, exactly that, a claim.

What the Threat Actor Is Claiming

TheHatman says the data came out of corporate Azure and Entra tenants, exfiltrated with leaked credentials. The records go well past names and work emails. Samples reviewed by Hudson Rock reportedly include phone numbers, physical addresses, employee IDs, job titles, department and manager details, user-group memberships, and service-account entries. Some listings, the researchers say, also flag accounts holding Global Administrator privileges. Even with no passwords attached, a directory that shows who runs a company's cloud tenant is a ready-made target list for phishing, spear-phishing, and business email compromise.

Hudson Rock assessed the data as "highly likely authentic," citing corporate email addresses and field structures consistent with exports from Microsoft Azure directory services. That is an analyst's judgment based on sample review, not proof that each named company was breached, and the distinction matters for every brand on the list. The firm was clear that its confidence covers the apparent authenticity of the samples, not the provenance of any single company's records.

Why Researchers Point to Compromised Credentials

The root cause, as the researchers frame it, is not a flaw in Azure. Hudson Rock said its infostealer database already held compromised Microsoft cloud credentials tied to most of the named companies, though it could not directly connect those credentials to TheHatman's access. Its read on the campaign is blunt: "Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure." If a single Azure vulnerability were to blame, the firm argued, the victim list would stretch far beyond a cluster of very large enterprises to include smaller businesses too.

The initial-access vector is still unproven. Hudson Rock floated several routes that fit the evidence: credentials or session cookies harvested by infostealer malware, phishing, weak or absent multi-factor authentication, and over-permissive third-party applications. That pattern rhymes with the credential-driven cloud intrusions we covered in the Snowflake customer-account breaches, where valid logins and switched-off MFA, not a platform exploit, opened the door to 165 organizations. The common thread is identity, not a specific product bug.

What the Named Companies Have Said

As of publication, the confirmations are thin. The Register said it contacted all nine organizations and Microsoft; the clearest response came from TCS, which pointed to a statement it filed with India's Bombay Stock Exchange. In it, the company said it "has investigated the matter and has not found any credible evidence of a breach of TCS systems or customer environments," adding that the referenced information "appears to be more than four years old and limited to basic employee information." TCS also said the attacker claimed password-spray and MFA-fatigue techniques, and that its safeguards against those "remain effective."

That leaves a wide gap between the seller's pitch and any confirmed breach. Microsoft has not publicly acknowledged a wider campaign against Azure or Entra customers. The other named brands had not, at the time of writing, confirmed the theft, vouched for the authenticity of the data, or explained how any access occurred. The right way to hold the numbers is as advertised counts from a criminal listing, not audited breach totals, and to keep the word "allegedly" attached until a company or Microsoft says otherwise on the record.

What Azure and Entra Defenders Should Verify

Whether or not these specific listings hold up, the failure mode they describe, valid credentials used against a cloud identity tenant, is the one worth pressure-testing now. For teams running Microsoft Azure and Entra ID, the useful posture is verification rather than reassurance. A handful of checks are worth running this week:

• Audit for credential and service-principal exposure. Cross-check your tenant's accounts against infostealer and credential-leak feeds, and inventory service principals for stale, unused, or over-privileged entries. The service-account and Global Administrator names called out in these listings are exactly what an attacker uses to plan the next move.
• Review conditional-access policies. Confirm that sign-in risk, device compliance, and location conditions actually block the paths TheHatman claimed to use, including password spray and MFA fatigue, rather than merely logging them.
• Rotate service-principal secrets and app credentials. Treat any client secret, certificate, or app credential that could have been exposed as compromised, and prioritize non-human identities, which rarely get rotated on a schedule.
• Enforce MFA everywhere. Require multi-factor authentication on every account, including break-glass and service accounts where feasible, with no legacy exceptions grandfathered in, and prefer phishing-resistant methods over push prompts that fatigue attacks exploit.
• Monitor for anomalous tenant data access. Alert on bulk directory reads, unusual Microsoft Graph queries, and directory exports from unfamiliar locations or applications, so a repeat of this exfiltration pattern surfaces as it happens rather than on a forum months later.

My Read

My read: the number to set aside is "millions," and the detail to keep is "service accounts and Global Admin names." A criminal counting records is doing marketing; a directory that maps who holds the keys to a cloud tenant is the actual risk, because it turns a generic phishing blast into a targeted one. TCS's response is the tell for how these stories usually resolve. Even when a company finds no credible sign of a fresh breach, stale directory data from an older credential compromise can resurface, get repackaged, and still power convincing social engineering. Both things can be true at once: no new intrusion, and real exposure sitting in someone's dataset.

The credential exposure that makes a campaign like this possible is the same seam that keeps splitting open, from Snowflake's customers to the secrets researchers found buried in AI agent logs. Attackers do not need an Azure zero-day when a valid login and a quiet tenant will do. Until a named brand or Microsoft confirms otherwise, this is an attacker's claim, and the defensible move is to verify your own tenant now rather than wait for a confirmation that may never arrive cleanly.

Primary Documents

• Hudson Rock (Infostealers.com), "Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials"
• The Register, "Crook hawks millions of records allegedly plundered from corporate Azure tenants" (Aug. 17, 2026)
• SecurityWeek, "Fortune 500 Companies Hit in Azure Data Theft Campaign" (Aug. 17, 2026)
• Tata Consultancy Services, statement to the BSE (PDF)