A threat actor known as “TheHatman” claims to have obtained millions of employee records from the Azure environments of several Fortune 500 companies, including McDonald’s, Vodafone, Kyndryl, and Tata Consultancy Services (TCS), according to Hudson Rock.
Over the past week, the threat actor has posted a string of large internal employee directories on cybercrime forums, claiming that each was pulled directly from the victim organization’s Azure tenant.
In addition to McDonald’s, Vodafone, Kyndryl, and TCS, the alleged victims include HCL Technologies, InterContinental Hotels Group (IHG), Gap Inc., Hexaware Technologies, and Wyndham Hotels.
Leaked data appears authentic
The volume of data on offer is large. McDonald’s tops the list with an estimated 1.7 million records, followed by TCS at around 800,000, Vodafone at roughly 425,000, and HCL at about 250,000. IHG, Kyndryl, Gap, Hexaware, and Wyndham round out the rest, with counts ranging from several thousand to over 170,000 records apiece.
Hacker forum post advertising the McDonald’s employee data leak (Source: Hudson Rock)
Hudson Rock researchers examined samples of the leaked data and found corporate email addresses and field names consistent with a standard Azure directory export, indicating that the material is likely authentic.
“While the data is highly likely authentic, it is not conclusive how this campaign is being carried out,” Hudson Rock said.
“However, the exact intrusion vector remains unknown. This mass exfiltration could be the result of active Infostealer infections compromising employee session tokens, highly successful phishing campaigns yielding administrative access, a lack of strict Multi-Factor Authentication (MFA) on specific tenant portals, or potentially an abuse of a third-party API/Integration that had excessive read privileges across multiple environments. The sheer scale and speed of these dumps suggest a systematic, automated approach once initial access is achieved,” they added.
According to Hudson Rock, each dump includes employee IDs, job titles, departments, manager and direct-report information, group memberships, service accounts, and, in some cases, the names of accounts holding Global Administrator privileges.
“The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations,” researchers warned.
Hudson Rock was careful to note that it has no definitive confirmation of which specific credentials were used to break into these organizations, only that compromised Azure logins tied to most of the named companies were circulating as a result of infostealer infections.
“Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure. If this were a widespread vulnerability, we would likely see a much broader spectrum of organizations impacted, including smaller businesses, rather than just these massive Fortune 500-level enterprises,” researchers noted.
TCS responds to employee data exposure claims
One of the nine named companies, TCS, filed a statement with the Bombay Stock Exchange on August 10 after receiving threat intelligence alerts about the possible exposure of employee data.
The company stated that it “has not found any credible evidence of a breach” of its own systems or customer environments.
TCS reported that the referenced information appears to be more than four years old and limited to basic employee details such as names, IDs, job titles, and contact information, adding that nothing points to customer data, customer systems, or its own operational systems being affected.
“The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. The Company has had strong safeguards in place against such techniques for more than two years. Based on the current review, these controls remain effective, and the Company continues to monitor the environment closely.”
“The Company will continue to assess any new information that becomes available and take appropriate action, if required,” it concluded.