Listings reportedly span nine firms and expose directory details that could enable phishing, impersonation, and privileged-account attacks

A threat actor using the alias “TheHatman” is offering millions of employee and account records allegedly taken from Microsoft Azure and Entra ID environments belonging to several large firms.

The campaign reportedly affects McDonald’s, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels, according to Security Week.

The hacker claims to have accessed the organizations’ cloud tenants with compromised credentials, rather than exploiting a vulnerability in Azure itself. Security analysts have guessed that the activity may be linked to credentials obtained through information-stealing malware or phishing campaigns, although the precise intrusion method has not been independently confirmed.

• McDonald’s is reportedly in the largest alleged dataset, with more than 1.7m records for sale.
• The other advertised collections include approximately 800,000 TCS records, 425,000 linked to Vodafone, 250,000 associated with HCL Technologies, 185,000 from InterContinental Hotels Group, 170,000 from Kyndryl, 80,000 from Gap, 20,000 from Hexaware Technologies, and 9,000 from Wyndham Hotels.
• Combined, the listings claim roughly 3.64m records.

The information described in the listings consists primarily of corporate directory data. Reported fields include employee names, business email addresses, phone numbers, office or business addresses, employee identification numbers, job titles, reporting-manager information, group memberships, service accounts, and records associated with highly privileged accounts.

Some of the data for sale is being disputed as outdated, and that such information does not by itself establish that an attacker had maintained access to a a firm’s data environment. Nevertheless, exposed corporate directories can assist targeted phishing, impersonation, credential theft, and attacks against privileged users, particularly when they reveal reporting relationships, account types, or administrative roles.

Additionally, the listings highlight the risks created by compromised cloud credentials. Even when a cloud provider’s underlying platform has not been breached, stolen administrative access can allow attackers to extract directory information from individual customer tenants. Organizations therefore face exposure not only from software vulnerabilities, but also from phishing, infostealer infections, password reuse, weak multifactor authentication, and inadequate monitoring of privileged accounts.