Full Report
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. [...]
Analysis Summary
# Incident Report: Multi-Organization Azure Data Exfiltration Campaign
## Executive Summary
A threat actor known as “TheHatman” has claimed responsibility for stealing and selling employee databases from several Fortune 500 companies, totaling over 3.6 million records. The actor alleges the data was exfiltrated directly from Microsoft Azure tenants using compromised credentials, while some affected organizations suggest the data may be aged or non-sensitive.
## Incident Details
- **Discovery Date:** July 31, 2026 (Initial advertisement of stolen data)
- **Incident Date:** Ongoing/Multiple dates (reported between July 31 and August 16, 2026)
- **Affected Organizations:** McDonald's, Gap Inc., Vodafone, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels (IHG), Wyndham Hotels, Hexaware, and Kyndryl.
- **Sector:** Diversified (Retail, Hospitality, Telecommunications, IT Services)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Various dates leading up to July 31, 2026.
- **Vector:** Compromised Credentials.
- **Details:** The threat actor claims to have gained access via password spraying and MFA fatigue (push notification spamming).
### Lateral Movement
- **Details:** While specific lateral movement steps were not detailed in the report, the actor claims to have accessed "Azure Tenants," suggesting movement from initial account compromise to cloud directory services.
### Data Exfiltration/Impact
- **Details:** Exfiltration of internal employee dumps. Stolen records include full names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and tenant account records.
### Detection & Response
- **Discovery:** The incident came to light through threat intelligence monitoring of cybercrime forums where "TheHatman" advertised the databases.
- **Response Actions:** Affected companies like TCS and Gap Inc. launched internal investigations, reviewed system logs, and issued public statements regarding the validity and age of the data.
## Attack Methodology
- **Initial Access:** Valid Accounts (Compromised Credentials).
- **Persistence:** Not explicitly detailed; likely via cloud service account access.
- **Credential Access:** Password Spraying, MFA Fatigue.
- **Collection:** Automated or manual export of Azure/Entra ID directory attributes.
- **Exfiltration:** Direct download from Azure Tenants.
- **Impact:** Data breach and potential for follow-on social engineering.
## Impact Assessment
- **Financial:** Unknown; potential costs related to forensic investigations and compliance notifications.
- **Data Breach:** High volume (3.64 million records); includes PII and internal directory structures.
- **Operational:** Low reported disruption to business operations.
- **Reputational:** High; involvement of multiple Fortune 500 brands in public leak advertisements.
## Indicators of Compromise
- **Network indicators:** N/A (Cloud-based exfiltration).
- **File indicators:** Database dumps containing `.onmicrosoft[.]com` structures and tenant-specific attributes.
- **Behavioral indicators:** Unusual login patterns (Password spraying), high volume of MFA push notifications to single users, and bulk export of directory data from Azure/Entra ID.
## Response Actions
- **Containment:** Verification of account security and rotation of credentials.
- **Eradication:** Investigation of the source of the leak to ensure no ongoing unauthorized access to Azure tenants.
- **Recovery:** Public communication and updates to regulatory bodies where applicable.
## Lessons Learned
- **MFA Vulnerabilities:** Standard push-based MFA is susceptible to "MFA Fatigue" attacks; organizations should consider more robust methods like FIDO2 or number matching.
- **Data Aging:** While some organizations claimed the data was old, the presence of service accounts and global admin names indicates that even "stale" directory data provides a roadmap for future attacks.
## Recommendations
- **Implement Phishing-Resistant MFA:** Transition from SMS or simple push notifications to hardware keys or certificate-based authentication.
- **Monitor Azure Logs:** Enable and monitor Entra ID (formerly Azure AD) sign-in logs for password spray patterns and "impossible travel" alerts.
- **Restrict Directory Permissions:** Apply the principle of least privilege to ensure only necessary personnel can export large volumes of user data from the cloud tenant.
- **Conditional Access:** Implement strict Conditional Access policies to limit logins from non-compliant devices or unexpected geographic locations.