Hacker Sells 3.6M Azure Records From McDonald's, Vodafone

There is no password in this dump, and that is the part worth attention. What a seller calling himself TheHatman has been listing on cybercrime forums since 31 July 2026 is duller and far more useful: employee directories. Names, corporate email addresses, job titles, who reports to whom and, in some listings, a roster of the Global Administrator accounts that run the tenant. The advertised total across nine datasets is 3.64 million records.

Key Takeaways

• A seller using the handle TheHatman advertised 3.64 million employee records allegedly exfiltrated from nine corporate Azure and Entra ID tenants, in listings posted between 31 July and 16 August 2026.
• The largest claimed dataset is attributed to McDonald's at more than 1.7 million records, followed by Tata Consultancy Services at over 800,000, Vodafone at 425,000 and HCL Technologies at 250,000.
• Tata Consultancy Services said it found no credible evidence of a breach and that the data appears at least four years old; Gap Inc. said it has no evidence its systems were compromised; McDonald's, Vodafone and Wyndham did not respond to reporters.
• Hudson Rock linked infostealer infections to compromised Azure credentials at several of the named companies, and the seller claims password spraying and MFA fatigue as the entry method.
• The listings reportedly include reporting lines, group memberships, service accounts and Global Administrator names, making this a spear phishing target map rather than a credential dump.

What Was Actually Claimed, and by Whom?

One forum seller claims to have exported employee directories from nine corporate tenants using stolen credentials, and no named company has confirmed him. BleepingComputer reported that TheHatman began posting on 31 July and was still adding listings on 16 August, advertising 3.64 million records in total.

The breakdown, in the seller's own numbers:

• McDonald's: more than 1.7 million records
• Tata Consultancy Services: more than 800,000
• Vodafone: more than 425,000
• HCL Technologies: more than 250,000
• InterContinental Hotels Group: more than 185,000
• Kyndryl: more than 170,000
• Gap Inc.: more than 80,000
• Hexaware Technologies: more than 20,000
• Wyndham Hotels: more than 9,000

Treat every figure as an advertisement. TCS investigated and said it found no credible evidence of a breach of its systems or customer environments, adding that the data appears at least four years old and limited to basic employee information. Gap Inc. said it has no evidence its corporate systems were compromised. McDonald's, Vodafone and Wyndham had not responded by publication, and Microsoft issued no statement. Nobody has confirmed a breach.

Why Is a Directory Worse Than a Password Dump?

Because there is nothing to rotate. A leaked password is a fifteen second problem with a well understood fix. You cannot reset your name, your job title, or the fact that you report to a particular vice president.

According to SecurityWeek, the advertised fields go well past a contact list: employee IDs, manager details and reporting structures, user group memberships, service accounts and global administrator names. Hudson Rock adds that the corporate email addresses arrive with live domains and tenant specific .onmicrosoft.com structures attached. That is what separates this from a scraped LinkedIn export. A scrape guesses at your address format. A tenant export knows it, along with the internal group you sit in.

The result is what an internal directory gives an employee, minus the accountability. It is the difference between knowing a company employs 1.7 million people and knowing which four of them can approve a wire transfer.

How Does an Org Chart Become a Wire Transfer?

Business email compromise runs on two facts: who holds authority, and who defers to them. A directory with reporting lines hands over both at once.

The mechanics are unglamorous. An attacker picks a named finance manager, finds the people reporting to them, registers a lookalike domain, then writes to a subordinate by name about a plausible internal matter. No malware. No attachment for a scanner to catch. It survives because it is correct about the org chart, and the recipient cannot tell that being correct just got cheap.

This is not a hypothetical loss category. The FBI's 2025 Internet Crime Report put BEC losses at $3.04 billion across 24,768 complaints, roughly $123,000 per incident. The attacks have also moved off email: BEC crews now follow the message with a phone call, which only works if the caller can name the right colleague.

The Global Administrator listings are the sharper edge. A labelled list of tenant admins turns a spray and pray campaign into a shortlist of perhaps a dozen accounts worth every hour an attacker can spend. Hudson Rock called that exposure a direct roadmap for privilege escalation.

The Tenant Is the Target Now

Nothing here involved breaking Azure. Hudson Rock identified compromised Azure credentials from infostealer infections tied to several named companies, and the seller cites password spraying and MFA fatigue rather than any vulnerability. Somebody logged in.

That is the shape of 2026. The identity provider is not broken, it is used exactly as designed by whoever holds a valid session. The same logic produced 48 million Gmail logins in an infostealer database, and again adversary in the middle kits hijacking Outlook sessions straight past MFA. Directory data is just the next thing worth taking once you are inside, and every tenant has one.

Here is the part the coverage has skipped. Even if TCS is right that its portion is four years old, an org chart ages gracefully. Address formats do not change, and most people keep the same manager for years. A four year old directory of a 600,000 person employer still yields tens of thousands of live addresses and a usable map of who answers to whom, which makes "it is old data" a far weaker defence than it would be against a password dump.

What Should You Do If Your Employer Is on the List?

Assume your work email address, title and manager are already public, then change how you treat internal looking mail. One rule covers most of it: any request touching money, credentials or access gets verified through a channel the message did not choose. Call the person on a number you already had. Never reply to the thread, and never dial a number the email supplied.

For the people running the tenant, the priorities follow the exposure:

• Move every Global Administrator to phishing resistant MFA, meaning passkeys or hardware keys rather than push notifications, which is what MFA fatigue attacks exist to defeat. CISA's guidance covers the distinction.
• Use cloud only admin accounts with no mailbox attached, so an admin identity is never the thing reading email.
• Tighten Conditional Access on privileged roles: compliant device required, sign in risk gates, and no legacy authentication anywhere.
• Restrict what an ordinary authenticated user can read from the directory, and alert on bulk enumeration through Graph.
• Watch privileged role changes closely. Researchers already showed how a new Entra agent role could be walked up to Global Admin in most tenants.

Looking Ahead

The claims may deflate. Sellers inflate counts, recycle old dumps and stitch scraped data into something that looks exported. TCS has a specific, checkable objection that may hold up for the rest of the list.

The incentive will not. A tenant directory is the cheapest thing to take once you hold credentials, the hardest thing to remediate, and the most directly convertible into a six figure payout. Expect the sentence "we have no evidence our corporate systems were compromised" to keep being technically true while somebody who never touched those systems reads the org chart anyway.