445/69 Tuesday, August 18, 2026
Preliminary reports indicate that a threat actor using the name TheHatman has advertised for sale data allegedly stolen from the Azure environments of several leading Fortune 500 organizations. The potentially affected organizations include global brands such as McDonald’s, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, and InterContinental Hotels Group (IHG). The alleged dataset contains millions of records and consists of internal employee directory information.
Cybersecurity company Hudson Rock stated that the leaked details include employee names, corporate email addresses, phone numbers, employee IDs, job titles, service account information, and high-privilege administrator account details. The largest dataset reportedly belongs to McDonald’s, with more than 1.7 million records, followed by TCS and Vodafone. The threat actor claimed to have extracted the data from Azure and Microsoft Entra ID instances using previously leaked credentials. Experts assess that these credentials were likely stolen through targeted infostealer malware campaigns. The exposure of internal organizational structures, particularly administrator accounts, poses a serious risk because attackers could use this information as a map to plan further attacks against affected systems.
As a result of this incident, the leaked information could be used for social engineering, targeted spear-phishing, and business email compromise (BEC) attacks. Administrators of organizations using Azure and Microsoft Entra ID should promptly review system logs for unusual data extraction activity, strictly enforce multi-factor authentication (MFA), and consider resetting passwords for at-risk accounts, especially administrator accounts. Organizations should also communicate with internal users to increase vigilance when reviewing suspicious emails or unusual contact attempts, in order to reduce the risk of fraud and prevent potential follow-on impact.
Source: https://www.securityweek.com/fortune-500-companies-hit-in-azure-data-theft-campaign/