Hackers are dumping millions of records from McDonald’s, Vodafone, and other Fortune 500 companies
Millions of records are allegedly exposed.
- A threat actor, TheHatman, is selling alleged Azure and Entra data from McDonald’s, Vodafone, TCS, and other giants.
- Listings claim millions of records, including employee emails, phone numbers, job titles, names, and workplace addresses.
- Researchers say compromised credentials and infostealer malware likely enabled access, not a confirmed Azure zero-day flaw.
- The exposed data could fuel convincing phishing and impersonation attacks against employees across large global organizations.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
McDonald’s, Vodafone, and other major companies have been targeted in an Azure credential theft campaign.
A threat actor has flooded the underground forums with datasets for sale, allegedly stolen from the Microsoft Azure and Entra cloud environments of some of the world’s largest companies, exposing information that could help criminals target employees.
The attacker, going under the alias “TheHatman,” has posted data linked to at least 9 major enterprises on underground forums over the past week:
- McDonald’s Corporation: 1,700,000 records
- TCS (Tata Consultancy Services): 800,000 records
- Vodafone: 425,000 records
- HCL Technologies: 250,000 records
- InterContinental Hotels Group (IHG): 185,000 records
- Kyndryl: 170,000 records
- Gap Inc.: 80,000 records
- Hexaware Technologies: 20,000 records
- Wyndham Hotels: 9,000 records
To prove their claims, the attacker shared data samples. While the download link to McDonald’s data sample was not functional when Cybernews researchers checked, the other companies' entries revealed what kinds of data may be included in the allegedly stolen datasets.
The sample records across the listings include:
- Employee emails
- Phone numbers
- Job titles
- Full names
- Workplace addresses
- Employee IDs
- Departments, notes, manager details, and direct reports.
- User group memberships
- Service accounts
- Highly privileged account records such as Global Administrator listings
We’ve reached out to the allegedly affected companies for comment and will update this article once we receive a response.
Companies and employees are at risk of social engineering attacks
“The impact for individuals is a heightened risk of social engineering attacks. Compromised credentials may be rotated by now, but in case it wasn't it could be used for further data exfiltration,” said Cybernews researchers.
An attacker with accurate information about an organization's employees, managers, departments, and reporting structures can construct highly convincing phishing messages.
A criminal could, for example, impersonate an employee's manager or an IT administrator and use real organizational details to make a request appear legitimate.
Attackers may have used infostealers
The data entries are consistent with Azure directory exports. The exact method used to access the companies remains unclear. TheHatman has claimed that the information was obtained using compromised credentials.
The cybersecurity firm Hudson Rock said it has identified evidence linking infostealer malware infections to compromised Azure credentials associated with several of the companies, including TCS, Gap, HCL Technologies, and Kyndryl.
Infostealers are malicious programs designed to steal information from infected computers, including passwords, browser data, and session cookies. Stolen session information can sometimes allow attackers to access online services without needing the victim's password again.
“Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure,” the company said.
“If this were a widespread vulnerability, we would likely see a much broader spectrum of organizations impacted, including smaller businesses, rather than just these massive Fortune 500-level enterprises.”
Hudson Rock researchers concludes that allegedly exfiltrated data is "highly likely authentic," as corporate email addresses and structures are consistent with exports from Microsoft Azure directory services.
Old data?
In the notification shared with the National Stock Exchange of India on August 10th, TCS claimed that the company has investigated the claims. However, TCS stated that it has not found any “credible evidence of a breach” of TCS systems or customer environments.
According to TCS, the information referenced appears to be more than four years old and limited to basic employee information.
“The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. The company has had strong safeguards in place against such techniques for more than two years,” says TCS.
Vodafone spokesperson told Cybernews that the company is investigating the claims, and assessments show that affected data is old.
“Our current assessment is that data is old Vodafone employee information that would be available on a business card. The information available could be accessed from an address list," the spokesperson said.
"No Vodafone customer data or impact has been identified. We have an international team of cyber security professionals who constantly protect, defend and monitor our systems,” the company added.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The cybersecurity community is outraged: “This is wild”
The scale of the campaign has drawn criticism from the cybersecurity community, who say the incident illustrates how damaging stolen credentials and session tokens can be even when companies have multi-factor authentication in place.
Some security professionals argued on Reddit that the attackers do not need to exploit a sophisticated vulnerability at all. Instead, stolen credentials or session tokens obtained through infostealer malware could provide enough access to extract entire corporate directories.
“The fact that ‘TheHatman’ is just dumping entire Azure Tenants shows how bad the Infostealer problem has gotten,” one commenter wrote.
The user speculated that the attacker could have obtained logs from an infostealer marketplace, used stolen session tokens to get around MFA protections, and then automated the collection of Entra ID directory data.
“If these massive orgs (like McDonald's and Vodafone) aren't strictly enforcing Continuous Access Evaluation (CAE), compliant device checks, and strict Conditional Access policies, their entire employee directories are just sitting ducks for anyone with a stolen session cookie,” they added.
“So preventable, for so many breaches originating from infostealers we had the creds YEARS prior to the attacks,” another commenter said.
Another described the scale of the alleged victims as “wild,” arguing that organizations of this size should have stronger systems for detecting compromised employee credentials.
Not everyone placed the responsibility solely on the affected companies. One Reddit user argued that Microsoft also has a role to play in reducing the impact of stolen credentials in its cloud ecosystem.
“These companies can definitely do more, but I don't think Microsoft should get off the hook,” the commenter wrote, pointing to security tools that can detect suspicious activity and trigger automated responses such as revoking sessions or disabling compromised accounts.
Updated on August 19th [10:20 a.m. GMT+2] with a statement from Vodafone.