# Threat Actor 'TheHatman' Claims Theft of 3.6M+ Azure/Entra Tenant Employee Records from McDonald's, Gap, Vodafone, TCS, and Six Others via Password Spray/MFA Fatigue; TCS and Gap Dispute the Claims

> A threat actor using the alias 'TheHatman' has flooded underground cybercrime forums since July 31, 2026 with listings claiming theft of over 3.6 million employee/tenant directory records from at least nine Fortune-500-level organizations' Microsoft Azure/Entra ID tenants via compromised credentials, password spray, and MFA fatigue. Threat-intel firm Hudson Rock verified sample authenticity and traced some of the underlying compromised Azure AD credentials to infostealer infections on employee machines at TCS, HCL Technologies, Gap, and Kyndryl, though it does not confirm infostealers as the access vector at every organization. TCS and Gap Inc. publicly dispute the claims, stating they found no evidence of compromise and that the data appears several years old.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2047
- **ID:** TL-2026-2047
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** TheHatman
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning July 31, 2026, a threat actor operating under the alias 'TheHatman' began posting listings on underground cybercrime forums offering internal employee directory dumps allegedly exfiltrated directly from victim organizations' Microsoft Azure and Microsoft Entra ID (Azure Active Directory) tenants. By mid-August 2026 the actor's listings covered at least nine Fortune-500-level enterprises spanning IT services, hospitality, telecommunications, retail, and logistics: McDonald's Corporation (1.7M+ records), Tata Consultancy Services (800,000+), Vodafone Group (425,000+), HCL Technologies (250,000+), InterContinental Hotels Group (185,000+), Kyndryl (170,000+), Gap Inc. (80,000+), Hexaware Technologies (20,000+), and Wyndham Hotels & Resorts (9,000+) — a combined total exceeding 3.64 million records.

The actor claims the data was obtained by directly accessing victim Azure tenants using compromised credentials, password spraying, and MFA fatigue (push-notification bombing) attacks. The exposed data reportedly includes full names, corporate email addresses, phone numbers, physical addresses, employee IDs, job titles, departments, manager/direct-report relationships, user group memberships, service account records, and Global Administrator identifiers — core Azure AD/Entra directory export fields.

Threat-intelligence firm Hudson Rock reviewed samples and assessed them as consistent with genuine corporate directory exports based on corporate email address formats and field structures, expressing 'high confidence' in authenticity. Independently, Hudson Rock's cybercrime intelligence platform identified compromised Azure AD credentials tied to infostealer malware infections on employee machines at several of the named organizations, including a machine infected in India holding stolen TCS Azure AD credentials, a compromised HCL Technologies employee credential (illustrating password-reuse risk), stolen Gap Inc. Microsoft credentials, and a Kyndryl-linked machine found to hold dozens of corporate credentials plus hundreds of sensitive browser session cookies. Hudson Rock explicitly cautions this does not establish infostealer infection as the confirmed initial-access vector at every named organization, and assessed that, given the scale of the organizations impacted, the campaign more likely stems from targeted exploitation of infostealer-derived credentials than a systemic Azure platform zero-day.

None of the named organizations have publicly confirmed compromise. Tata Consultancy Services stated it found 'no credible evidence of a breach,' that the data is 'at least four years old,' contains 'only basic employee information,' and that TCS deployed safeguards against such techniques more than two years ago. Gap Inc. stated it found 'no evidence to suggest that our corporate systems have been compromised' and that the data is 'limited in scope, non-sensitive, and dated back to several years ago.' BleepingComputer and other outlets were unable to independently verify the claims, and the precise initial-access vector and exfiltration method remain unconfirmed as of August 17, 2026. No CVE or Azure platform vulnerability has been identified or implicated; this is a credential/identity-based intrusion claim, not a software vulnerability.

Regardless of the disputed authenticity, Hudson Rock and other researchers note the exfiltrated data — particularly service account records and Global Administrator names — provides a reconnaissance roadmap for follow-on social engineering, spearphishing, and privilege-escalation attacks against the named organizations and their employees.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1650 Acquire Access
- T1078 Valid Accounts
- T1110 Brute Force
- T1621 Multi-Factor Authentication Request Generation
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1213 Data from Information Repositories

## Sources

- [Hacker claims 3.6 million Azure account records stolen from major companies](https://www.bleepingcomputer.com/news/security/hacker-claims-36-million-azure-account-records-stolen-from-major-companies/)
- [Crook hawks millions of records allegedly plundered from corporate Azure tenants](https://www.theregister.com/security/2026/08/17/crook-hawks-millions-of-records-allegedly-plundered-from-corporate-azure-tenants/5288305)
- [Fortune 500 Companies Hit in Azure Data Theft Campaign](https://www.securityweek.com/fortune-500-companies-hit-in-azure-data-theft-campaign/)
- [Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (McDonald's, Vodafone, Kyndryl & Others)](https://www.infostealers.com/article/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonalds-vodafone-kyndryl-others/)
- [TCS, HCL, Hexaware named in global Azure directory data leak linked to infostealers](https://www.crnasia.com/india/news/2026/tcs-hcl-hexaware-named-in-global-azure-directory-data-leak-linked-to-infostealers)
- [McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records](https://cybersecuritynews.com/azure-credential-theft-campaign/)
- [Hackers dump millions of records from McDonald's, Vodafone, and Fortune 500 companies](https://cybernews.com/security/mcdonalds-vodafone-azure-microdoft-credential-theft/)
- [McDonald's, Vodafone Hit in Massive Azure Credential Theft Campaign](https://gbhackers.com/mcdonalds-vodafone-hit-in-massive-azure-credential-theft-campaign/)
- [Azure Cloud Credential Theft leads to Data Breach of McDonald's and Vodafone](https://www.cybersecurity-insiders.com/azure-cloud-credential-theft-leads-to-data-breach-of-mcdonalds-and-vodafone/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2047