News · Insight

Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS

A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials, including more than 1.7 million records attributed to McDonald's. No platform vulnerability was needed. Valid credentials were enough.

A credential theft campaign is being used to lift entire employee directories out of corporate Azure and Entra tenants, and the results are now being sold on underground forums. Cyber Security News reports that a seller using the alias TheHatman has listed data from at least nine Fortune 500-level organisations in the space of a week.

The scale of the listings

The largest listing is attributed to McDonald's Corporation at more than 1.7 million records, followed by Tata Consultancy Services at roughly 800,000, Vodafone at approximately 425,000 and HCL Technologies at around 250,000. Further listings name InterContinental Hotels Group at about 185,000, Kyndryl at 170,000, Gap Inc. at 80,000, Hexaware Technologies at 20,000 and Wyndham Hotels at 9,000. Hudson Rock researchers who reviewed sample datasets describe the material as highly credible, noting corporate email domains and field structures consistent with a standard Azure directory export.

What the records contain

Each dataset follows the same template. Names, corporate email addresses, phone numbers and physical addresses sit alongside organisational detail: employee identifiers, job titles, departments, manager assignments and direct reports. Some listings go further and include access and group mapping, service account detail, and in places the names of Global Administrator accounts.

How the access was obtained

The entry point is unconfirmed. The seller says only that compromised credentials were used. Hudson Rock reports finding Azure credentials tied to infostealer infections linked to most of the affected companies, including machines traced to employees at TCS, Gap Inc., HCL Technologies and Kyndryl, with one device holding dozens of corporate credentials and hundreds of session cookies. Other plausible routes include phishing that yielded administrative access, tenants without strict multi-factor enforcement, and third-party integrations holding overly broad read permissions. Notably, only very large multinationals appear, which points to targeted use of stolen credentials rather than a flaw in the platform itself.

Why a directory is not a low-value loss

An accurate directory is an operational asset for an attacker. Reporting lines and job titles make business email compromise convincing, because the request appears to come from the right manager to the right person. Named service accounts and administrators turn a broad estate into a short target list for initial access brokers and ransomware crews. The directory is often the map that makes the second intrusion faster than the first.

The Firevault view

Every record in these listings was reachable with a valid credential. That is the whole mechanism. Once identity is the only barrier, a stolen session cookie inherits the same reach as the employee it was taken from, and no amount of perimeter tooling changes that arithmetic.

Offline Secure Storage® removes the arithmetic instead of arguing with it. Retained personnel files, HR records and organisational archives sit on hardware that is physically disconnected, so a compromised tenant credential has nothing to enumerate and nothing to export. For live operational systems, Control by Firevault keeps the route closed by default and opens it for a named person, for a defined task, then severs it again, so a stolen credential does not arrive holding an open path.

Reported by Mark Fermor, drawing on Cyber Security News and Hudson Rock research.