The short answer
Starting July 31, 2026, a threat actor known as “TheHatman” began selling employee databases allegedly exfiltrated from the Microsoft Azure and Entra ID tenants of multiple Fortune 500 companies, including McDonald's, Vodafone, Tata Consultancy Services, and HCL Technologies. The total claimed volume is 3.64 million records. Hudson Rock, which reviewed samples, assessed the data as “highly likely authentic” and identified infostealer-harvested Azure credentials linked to several of the named organizations circulating in underground markets. The attack does not appear to exploit a vulnerability in Azure itself — it used valid stolen credentials to log in as legitimate users and export directory data.
The incident was first reported by The Register on August 17, 2026 and covered by BleepingComputer and Help Net Security the following day. TCS has publicly stated it found no credible evidence of a breach of its own systems; other named companies had not issued formal statements at the time of publication.
What happened: infostealer to Azure directory
The attack chain has two links. First, infostealer malware — a category of credential-harvesting software that silently extracts saved passwords, browser cookies, and session tokens from infected endpoints — compromised devices belonging to employees at the targeted companies. Once active on an endpoint, infostealers harvest every cloud credential they can find: Microsoft 365 tokens, Azure management portal logins, Entra ID admin accounts. These stolen credentials are then sold or traded in underground markets.
Second, the attacker used those harvested credentials to authenticate directly to the victims’ Microsoft Azure and Entra ID tenants as legitimate users. From inside the tenant, exporting the employee directory — which Azure exposes through its Graph API and admin portal to authenticated users with sufficient permissions — is a low-friction operation that leaves footprints only if the right audit logs are monitored. Hudson Rock notes that it “identified compromised Azure credentials linked to infostealer activity” at several named companies, corroborating the claimed vector without being able to confirm which specific credential was used for each individual export.
The reason this attack chain is so effective is that it bypasses perimeter defenses entirely. There is no exploit, no malicious payload delivered to the Azure infrastructure, no network intrusion in the traditional sense. The attacker logs in with a real password and a valid (or recently invalidated) session token, navigates to the directory, and exports it. From Azure’s perspective, the session looks like an ordinary admin action.
Who was affected and what data was taken
The claimed scope is broad. McDonald's tops the list at an alleged 1.7 million records, followed by Tata Consultancy Services at approximately 800,000, Vodafone at roughly 425,000, and HCL Technologies at around 250,000. The remainder of the 3.64 million total is distributed across Gap Inc., InterContinental Hotels Group, Kyndryl, Hexaware Technologies, and Wyndham Hotels.
What makes the data particularly sensitive is not just the volume but the richness of the directory schema. Samples reviewed by Hudson Rock reportedly included corporate email addresses, phone numbers, physical office addresses, employee IDs, job titles, departmental org charts showing who reports to whom, Active Directory group memberships, and details of service accounts. Critically, some records reportedly identified accounts carrying Global Administrator privileges in Entra ID. That last category is a targeting list: an attacker who knows which accounts hold the highest-privilege roles in a tenant has a ready-made map for the next phase of a broader intrusion.
TCS filed a statement with the Bombay Stock Exchange on August 10 after receiving threat-intelligence alerts, stating it “has not found any credible evidence of a breach” of its own systems or customer environments. None of the other named companies had issued public statements by the time of first reporting.
Why this matters beyond the headline numbers
Leaked employee directories are frequently treated as lower-severity incidents compared to financial data or health records breaches — a classification that underestimates their downstream value to attackers. A complete org chart with email addresses and reporting structures is the foundation for targeted spear-phishing and business email compromise (BEC) campaigns. Knowing that “Alice in Finance reports to Bob, the CFO” allows an attacker to craft a highly convincing impersonation of Bob requesting an urgent wire transfer from Alice.
The inclusion of service accounts and their Entra ID group memberships raises the severity further. Service accounts often carry elevated permissions and are rarely monitored as closely as human accounts. If any of those service accounts used passwords that appear elsewhere in infostealer dumps, they become immediate pivot points into production infrastructure, CI/CD pipelines, or data warehouses.
For organizations covered by the EU General Data Protection Regulation, any confirmed exfiltration of personal employee data triggers a 72-hour breach notification obligation to the relevant supervisory authority, regardless of whether the breach was caused by a platform flaw or a stolen credential. GDPR Article 33 does not distinguish between intrusion methods. The Vodafone and IHG exposures, if confirmed, would activate notification requirements across multiple EU member states.
What it means for US & EU software teams
The systemic issue this incident exposes is the gap between cloud-tenant security and endpoint security. Teams that have invested heavily in Entra ID Conditional Access, threat detection, and Zero Trust architecture can still be compromised if an infostealer runs undetected on a developer’s laptop for long enough to harvest a valid session token. Session tokens in modern identity systems can remain valid for hours to days, and many infostealers specifically target them rather than passwords, because tokens bypass MFA entirely.
Software teams building on Azure are particularly exposed to this pattern because developer environments tend to accumulate broad permissions. A developer who has been granted Entra ID Directory Reader, or who is a member of a group with elevated Azure resource permissions, becomes a high-value target for any infostealer campaign. The principle of least privilege — well understood at the infrastructure layer — is frequently violated at the developer-role layer because it creates friction in daily work.
The practical takeaway for engineering leaders is to treat endpoint hygiene as a first-class cloud security control, not a separate IT concern. Infostealer infections spread through phishing emails, malicious browser extensions, trojanized developer tools, and cracked software. A team that deploys Zero Trust network access but allows developers to install unvetted browser extensions has a gap that attackers will find.
What to do now: a practical checklist
- Audit Entra ID sign-in logs for large directory export operations. In the Microsoft Entra admin center, navigate to Identity → Monitoring & health → Audit logs and filter for operations like “Export directory”, “Get users” at bulk scale, or Graph API calls that returned large result sets. Look back at least 90 days. Anomalous logins from new geographies, unfamiliar devices, or outside business hours in this time window warrant immediate investigation.
- Enforce phishing-resistant MFA for all privileged accounts, especially Global Administrators and service accounts. Password-only authentication and SMS-based MFA are both inadequate. Require FIDO2 hardware keys or Microsoft Authenticator with number matching (which defeats push-bombing) for any account with directory-level permissions. Apply Conditional Access policies that block legacy authentication protocols, which cannot support MFA at all.
- Rotate credentials for service accounts that may have been accessible from compromised sessions. If any human account in your tenant had access to service account credentials, API keys, or secrets during the suspicious window, rotate those credentials now. Prioritize secrets stored in environment variables, CI/CD pipeline configurations, and Azure Key Vault entries accessible to the accounts in question.
- Review the scope of developer permissions in Entra ID. Check which developer accounts hold Directory Reader, User Administrator, or Global Administrator roles, and whether group memberships grant implicit access to sensitive Azure resources. Apply least-privilege: developers building on Azure rarely need directory-level read permissions for their day-to-day work. Remove what is not necessary.
- Assess your endpoint infostealer exposure. Review EDR telemetry for browser credential-harvesting behavior, unexpected process injection into browser processes, and network connections to known infostealer C2 infrastructure. If you do not have an EDR solution covering developer workstations, that gap is now a documented cloud security risk, not just an endpoint management oversight.
- If you are covered by GDPR, assess notification obligations. Under GDPR Article 33, a personal data breach involving employee records triggers a 72-hour notification obligation to your lead supervisory authority if there is a risk to the rights and freedoms of individuals. Consult your Data Protection Officer immediately if your organization is one of the named companies or if an internal investigation reveals similar credential exposure.
Frequently asked questions
How did the Azure credential theft campaign work?
The attacker used credentials harvested by infostealer malware from infected employee endpoints at the target companies. Those credentials granted access to corporate Microsoft Azure and Entra ID tenants, from which the attacker exported employee directory data. Hudson Rock identified compromised Azure credentials linked to infostealer infections at several named companies, corroborating the claimed vector.
Which companies were affected?
The threat actor claimed data from McDonald's (~1.7M records), TCS (~800K), Vodafone (~425K), HCL Technologies (~250K), Gap Inc., IHG, Kyndryl, Hexaware Technologies, and Wyndham Hotels — 3.64 million records in total. TCS has publicly denied finding credible evidence of a breach of its own systems. Other companies had not issued formal statements at the time of first reporting.
What data was exposed?
Samples reviewed by Hudson Rock reportedly included corporate emails, phone numbers, physical addresses, employee IDs, job titles, departments, org-chart reporting structures, Active Directory group memberships, and service account details. Notably, some records identified accounts with Global Administrator privileges in Entra ID, which would provide a high-value targeting list for follow-on attacks.
What is an infostealer and how does it enable this kind of attack?
An infostealer is malware that silently extracts saved credentials, session tokens, and browser-saved passwords from infected devices. When an employee's device is infected, the infostealer harvests Azure and Microsoft 365 tokens and sends them to the attacker. Because the login uses valid credentials, it often bypasses perimeter defenses. If a recently valid session token is captured, it can bypass MFA entirely.
Does this mean Azure itself has a security flaw?
No. Researchers concluded the attack used infostealer-harvested credentials, not a systemic Azure or Entra ID platform vulnerability. A widespread platform flaw would indiscriminately affect small businesses as well. Microsoft has not issued a security advisory attributing this incident to a platform defect. The root cause is credential theft at the endpoint level.
What should engineering teams do to protect their Azure tenants?
Enforce phishing-resistant MFA (FIDO2 or Authenticator with number matching) for all accounts. Audit Entra ID sign-in logs for anomalous bulk directory exports over the past 90 days. Block legacy authentication protocols via Conditional Access. Rotate service-account credentials and API keys where there is any doubt. Review developer-role permissions to enforce least privilege. And treat endpoint infostealer hygiene as a first-class cloud security control, not a separate IT matter.
Sources
The Register — Crook hawks millions of records allegedly plundered from corporate Azure tenants (August 17, 2026)
BleepingComputer — Hacker claims 3.6 million Azure account records stolen from major companies
Help Net Security — Hacker claims millions of records stolen from corporate Azure tenants (August 18, 2026)
SC Media — McDonald’s employee records allegedly stolen from Azure