A threat actor calling itself TheHatman is offering millions of records allegedly taken from Azure/Entra tenants at large firms, including McDonald’s, TCS, Vodafone, HCL Technologies, and IHG. The biggest claimed dump is McDonald’s, with more than 1.7 million records.
The datasets look like legitimate directory exports: employee names, emails, phone numbers, job titles, manager details, group membership, service accounts, and highly privileged account records. That matters because it gives an attacker the internal map needed to pick the right executive, admin, or finance contact for convincing phishing, business email compromise, or privilege escalation.
For organizations that run centralized identity in Microsoft cloud directories, this is not just a privacy leak. A stolen tenant export can turn one credential theft into company-wide targeting of the people and accounts that actually control access and money.
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials.