A threat actor known as TheHatman is selling alleged employee databases stolen from Microsoft Azure and Entra tenants of multiple Fortune 500 companies, including McDonald’s, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The posts claim millions of records were accessed using compromised credentials, while some affected companies say the data appears old, limited, or unrelated to any confirmed breach. #MicrosoftAzure #Entra #McDonalds #GapInc #Vodafone #TataConsultancyServices #HCLTechnologies #InterContinentalHotels #WyndhamHotels #Hexaware #Kyndryl #TheHatman
Keypoints
- TheHatman is advertising employee database dumps from several major companies.
- The alleged access came through compromised credentials in Microsoft Azure tenants.
- McDonald’s is said to have the largest dump, with more than 1.7 million records.
- Tata Consultancy Services and Gap Inc. both said they found no credible evidence of a breach.
- Hudson Rock says the data includes service accounts and administrator names that could aid spearphishing.