# Azure Credential Theft Campaign Exposes Millions of Enterprise Records at McDonald's, Vodafone, TCS

> A threat actor operating under the alias "TheHatman" is flooding underground cybercrime forums with Azure Entra ID directory data stolen from nine major enterprises — McDonald's, TCS, Vodafone, HCL Technologies, IHG, Kyndryl, Gap Inc., Hexaware, and Wyndham — totaling roughly 3.6 million employee/service-account records. Hudson Rock traced the access for at least four of the nine victims (TCS, Gap Inc., HCL Technologies, Kyndryl) to infostealer-harvested Azure AD credentials and session cookies; the attacker separately claims password spraying and MFA fatigue against TCS's tenant. TCS has publicly disputed the breach, stating it found no evidence of compromise and that the sample data appears to be over four years old.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2028
- **ID:** TL-2026-2028
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** TheHatman
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning in the week leading up to 2026-08-16, a threat actor using the handle "TheHatman" began advertising bulk Microsoft Entra ID (Azure Active Directory) directory exports from nine global enterprises on underground cybercrime forums. The listings span roughly 3.6 million combined records: McDonald's (~1.7M), Tata Consultancy Services (~800K), Vodafone (~425K), HCL Technologies (~250K), InterContinental Hotels Group (~185K), Kyndryl (~170K), Gap Inc. (~80K), Hexaware Technologies (~20K), and Wyndham Hotels & Resorts (~9K).

Each dataset reportedly contains full names, corporate email addresses (including tenant-specific `.onmicrosoft.com` structures), phone numbers, physical addresses, employee IDs, job titles, departments, manager/reporting-structure assignments, service-account details, user group memberships, access/group mapping data, and — most critically — Global Administrator account listings, along with tenant-specific credential material.

Hudson Rock's cybercrime intelligence platform reviewed sample data and assessed it as highly credible, citing corporate email domains and field structures that align precisely with standard Azure directory export formats. Hudson Rock traced compromised Azure AD credentials tied to infostealer infections to at least four of the nine victims: a TCS employee device infected in India; Gap Inc.; HCL Technologies; and a Kyndryl-linked machine found to contain "dozens of corporate credentials and hundreds of sensitive session cookies, including direct access to a Kyndryl Azure Active Directory account." The precise access vector for the remaining five organizations (McDonald's, Vodafone, IHG, Hexaware, Wyndham) is not confirmed in public reporting; researchers describe it as "not conclusive" and cite phishing campaigns yielding administrative access, weak/absent MFA enforcement, and third-party API/integration abuse with excessive read privileges as other plausible vectors alongside infostealer credential theft.

For the TCS listing specifically, the seller separately claimed the ~800,000-record dataset (with a ~6,000-record public sample) was obtained via password spraying and MFA fatigue (push-bombing) against TCS's Entra ID tenant, and sought a negotiable price for the full dataset. TCS filed a regulatory/exchange disclosure on 2026-08-10 stating it found "no credible evidence of a breach" of its systems or customer environments, that the sampled data "appears to be" more than four years old and consists only of basic employee fields, and that its anti-password-spraying and anti-MFA-fatigue safeguards have been in place and effective for over two years. TCS's claimed workforce (~590,000) is notably smaller than the ~800,000 records advertised, a discrepancy TCS did not address. TCS said it is continuing to monitor and will act on new evidence; it has not disclosed employee-notification or law-enforcement plans. This dispute does not affect Hudson Rock's independent infostealer-based findings for the other three corroborated victims (Gap Inc., HCL Technologies, Kyndryl), or the fourth infostealer-linked victim, TCS itself — Hudson Rock's infostealer evidence and TCS's public denial are not mutually exclusive, since infostealer-harvested credentials can predate the stale data TCS describes.

No CVE, malware family name, or network/file IOC (IP, domain, hash) has been published for this campaign as of this writing — the exposure stems from stolen identity/session material and directory-service abuse rather than a software vulnerability. Researchers assess the exposed directory data as directly weaponizable for business email compromise, targeted spear-phishing, privilege-escalation attempts against the identified Global Administrator accounts, and as a reconnaissance foothold for follow-on ransomware initial-access operations against the nine affected organizations.

## MITRE ATT&CK

- T1589.001 Gather Victim Identity Information: Credentials
- T1078.004 Valid Accounts: Cloud Accounts
- T1566 Phishing
- T1078.004 Valid Accounts: Cloud Accounts
- T1110.003 Brute Force: Password Spraying
- T1621 Multi-Factor Authentication Request Generation
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1087.004 Account Discovery: Cloud Account
- T1069.003 Permission Groups Discovery: Cloud Groups
- T1119 Automated Collection
- T1657 Financial Theft

## Sources

- [McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records](https://cybersecuritynews.com/azure-credential-theft-campaign/)
- [Dozens of Global Companies Hacked via Cloud Credentials from Infostealer Infections & More at Risk](https://www.hudsonrock.com/blog/dozens-of-global-companies-hacked-via-cloud-credentials-from-infostealer-infections-more-at-risk)
- [Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (McDonald's, Vodafone, Kyndryl & Others)](https://www.infostealers.com/article/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonalds-vodafone-kyndryl-others/)
- [Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (McDonald's, Vodafone, Kyndryl & Others) mirror](https://malware.news/t/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonald-s-vodafone-kyndryl-others/124832)
- [IT Services Sector / Cloud Infrastructure Alert — TheHatman Azure Directory Data Sale](https://x.com/VECERTRadar/status/2083377562814664741)
- [TCS Faces Employee Data Exposure Claim; Says No Evidence Of Systems Breach](https://www.outlookbusiness.com/corporate/tcs-faces-employee-data-exposure-claim-says-no-evidence-of-systems-breach)
- [TCS says leaked employee data 'appears to be' over four years old](https://www.crnasia.com/india/news/2026/tcs-says-leaked-employee-data-appears-to-be-over-four-years-old)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2028