Massive Azure Breach Hits McDonald’s, Vodafone, TCS and More

A threat actor known as TheHatman is selling internal employee directories allegedly exfiltrated from the Azure and Entra tenants of McDonald’s, Vodafone, and seven other Fortune 500 companies, cybersecurity firm Hudson Rock reported this week. The McDonald’s dataset alone totals more than 1.7 million records.

What to Know?

• McDonald’s, Vodafone, TCS, and six other companies had employee data pulled from their Azure and Entra tenants, a seller claims.
• A threat actor using the handle TheHatman has posted the datasets on cybercrime forums over the past week.
• McDonald’s carries the largest exposure at more than 1.7 million records, followed by TCS at more than 800,000.
• Hudson Rock linked compromised Azure credentials from Infostealer infections to employees at most of the named companies.
• Leaked fields include job titles, managers, service accounts, and Global Administrator listings that enable targeted phishing.

How It Happened?

TheHatman began flooding cybercrime forums with the directories over the past week, targeting nine companies across IT services, hospitality, telecommunications, retail, and logistics. Cybersecurity firm Hudson Rock reviewed the samples and found the corporate email addresses and field names match standard Azure directory exports. The seller says every dataset was downloaded straight from the victims’ Azure and Entra tenants using stolen credentials.

A massive data breach has exposed millions of records from Fortune 500 companies, including McDonald’s and Vodafone, due to compromised Azure credentials. This incident underscores the critical need for robust credential management, multi-factor authentication, and vigilant… pic.twitter.com/EQkPatzvYA

— The Daily Tech Feed (@dailytechonx) August 16, 2026

McDonald’s tops the list by a wide margin. The full breakdown across all nine companies follows:

TheHatman has not described the exact intrusion method beyond citing compromised credentials, and Hudson Rock calls the vector inconclusive. The access could trace to Infostealer malware harvesting session tokens, a successful phishing run that reached administrative accounts, weak or absent multi-factor authentication on specific tenants, or a third-party integration with excessive read privileges across environments.

What the Data Exposes?

Each leaked directory carries the same three tiers of fields, according to Hudson Rock. Core identity records list full names, corporate email addresses (including internal .onmicrosoft.com tenant addresses), phone numbers, and physical addresses. Organizational fields add employee IDs, job titles, departments, manager names, and direct reports.

The riskiest tier covers access and group mappings: user group memberships, service accounts, and Global Administrator listings. “The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations,” Hudson Rock said. Similar tenant-level exposure has surfaced before, including the Microsoft Entra ID tenant flaw patched earlier this year and the identity gaps tracked in identity theft statistics compiled across the industry.

The Infostealer Trail

Hudson Rock’s own telemetry ties the breach claims to prior credential theft. The company identified a compromised Azure Active Directory account belonging to a TCS employee, traced to a machine infected in India. Separate infections exposed a Gap Inc. corporate Microsoft account and an HCL Technologies employee credential flagged for password reuse.

One machine tied to Kyndryl held dozens of corporate credentials and hundreds of sensitive cookies, including direct access to a Kyndryl Azure Active Directory account. Hudson Rock argues the pattern points to targeted Infostealer exploitation rather than a systemic Azure vulnerability, since a platform wide flaw would likely have hit smaller businesses too instead of only Fortune 500-level firms. The campaign’s blast radius so far stays confined to large enterprises, echoing the credential-driven exposure in the Zscaler Salesloft Drift breach and the APT29 Microsoft authentication attack Amazon disrupted.

Employees at the nine named companies should treat unexpected password reset prompts, MFA push requests, or messages that reference their manager or department by name as suspicious until verified through a separate channel. Security teams at those firms can use this window to revoke active sessions and rotate credentials tied to any account flagged in threat intelligence feeds, which helps reduce the odds that stolen directory data turns into a successful intrusion.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Why It Matters?

Structured directory data turns an anonymous attacker into a convincing insider overnight. Knowing exact reporting lines, department names, and job titles lets a scammer impersonate a manager convincingly enough to push through a fraudulent wire transfer or extract an MFA code. The presence of named Global Administrators also hands ransomware affiliates a shortlist of accounts worth targeting first.

Affected organizations should expect Hudson Rock and other cybercrime intelligence firms to keep monitoring dark web forums for further TheHatman listings tied to the same campaign. Enterprises running large Azure and Entra tenants can reduce exposure by enforcing phishing resistant MFA on admin roles, auditing which service accounts still hold Global Administrator privileges, and screening employee devices for Infostealer infections before those credentials reach a forum listing.