# "TheHatman" Azure/Entra Directory Exfiltration Campaign Exposes Millions of Employee Records at McDonald's, Vodafone, Kyndryl, TCS, HCL and Others

> A threat actor using the handle "TheHatman" is selling internal Azure/Microsoft Entra ID employee-directory exports from at least nine Fortune 500-scale organizations on the BreachForums cybercrime forum, exposing PII, service-account data, and Global Administrator identities for roughly 3.6 million employees combined. Hudson Rock traced the root cause to Azure credentials harvested by infostealer malware and, in TCS's case, to a specific infostealer-infected machine in India; several named victims (TCS, HCLTech) dispute an active breach and characterize the exposed data as several years old.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2027
- **ID:** TL-2026-2027
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** TheHatman
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning in the days before August 16, 2026, a threat actor operating under the alias "TheHatman" began flooding the BreachForums cybercrime marketplace with internal employee-directory exports claimed to have been pulled directly from the Microsoft Azure/Entra ID tenants of nine large enterprises: McDonald's Corporation (~1.7M records), Tata Consultancy Services (~800K), Vodafone (~425K), HCLTech (~250K), InterContinental Hotels Group (~185K), Kyndryl (~170K), Gap Inc. (~80K), Hexaware Technologies (~20K), and Wyndham Hotels (~9K) — roughly 3.6 million employee records across IT services, telecommunications, hospitality, retail, and quick-service-restaurant sectors.

The exposed fields consistently include full names, corporate email addresses, phone numbers, physical addresses, employee IDs, job titles, departments, manager/direct-report relationships, user group memberships, service-account entries, and — critically — listings of accounts holding the Global Administrator role, along with tenant-specific *.onmicrosoft.com structure. Cybercrime-intelligence firm Hudson Rock (via its Cavalier platform) independently reviewed the listings and found the data structurally consistent with genuine Azure directory exports, and separately identified compromised Azure Active Directory credentials tied to infostealer infections for most of the named victims — in TCS's case, tracing the exposed credential to a specific machine infected with infostealer malware in India.

TheHatman's own BreachForums listing for the TCS dataset (~800,000 records, with a ~6,000-record proof sample and buyer contact via Session, Tox, and Jabber) claims the tenant was accessed via password spraying combined with MFA-fatigue (push-bombing) attacks, a claim distinct from — but not necessarily exclusive of — the infostealer-credential root cause Hudson Rock identified; the exact initial-access chain has not been independently confirmed by any victim. A parallel 2,200-record sample published for the Kyndryl listing explicitly calls out accounts carrying the Global Administrator role, underscoring that the actor is marketing privileged-identity visibility, not just generic PII.

Victim response has been mixed and largely skeptical of an active, ongoing compromise. TCS filed a BSE stock-exchange disclosure on August 10, 2026 acknowledging the threat-intelligence alert but stating it found no credible evidence of a breach of its systems or customer environments, that the ~800,000-record claim exceeds its own ~590,000-person workforce, and that the sampled data appears to be more than four years old. HCLTech similarly disputed the claim, describing any genuinely exposed data as "limited and potentially years old," asserting no client-system impact, and noting mitigations it implemented roughly two years prior remain effective. Neither company has fully ruled out that older, previously unreported exposure underlies the current listings. McDonald's, Vodafone, IHG, Kyndryl, Gap, Hexaware, and Wyndham had not issued public statements addressing this specific campaign as of the primary reporting.

Regardless of whether the underlying data is current or several years old, the structured exposure of manager hierarchies, service-account naming, group memberships, and — especially — Global Administrator identities gives any purchaser a ready-made reconnaissance package for highly targeted Business Email Compromise, spear-phishing, and follow-on privilege-escalation attempts against nine large, high-profile enterprises simultaneously.

## MITRE ATT&CK

- T1589.001 Credentials
- T1650 Acquire Access
- T1555 Credentials from Password Stores
- T1110.003 Password Spraying
- T1621 Multi-Factor Authentication Request Generation
- T1078.004 Cloud Accounts
- T1087.004 Cloud Account
- T1069.003 Cloud Groups
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service

## Sources

- [Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (McDonald's, Vodafone, Kyndryl & Others)](https://www.infostealers.com/article/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonalds-vodafone-kyndryl-others/)
- [Tata Consultancy Services: TCS flags data leak claims, finds no breach](https://blog.rankiteo.com/tat1786447303-tata-consultancy-services-breach-august-2026/)
- [HCLTech and TCS: HCLTech says stolen data may be years-old after hacker's data breach claims](https://blog.rankiteo.com/hcltat1786448292-hcltech-tcs-breach-august-2026/)
- [TCS says leaked employee data 'appears to be' over four years old](https://www.crnasia.com/india/news/2026/tcs-says-leaked-employee-data-appears-to-be-over-four-years-old)
- [TCS data leak alert: IT firm says attackers claim potential employee data breach; will this impact customers?](https://upstox.com/news/business-news/latest-updates/tcs-data-leak-alert-it-firm-says-attackers-claim-potential-employee-data-breach-will-this-impact-customers/article-198465/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2027