--- title: "Azure credential theft campaign exposes million… | Firevault" url: https://fire-vault.com/news/employee-directories-azure-credential-theft-2026 description: "A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials,…" lang: en-GB --- News · Insight # Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials, including more than 1.7 million records attributed to McDonald's. No platform vulnerability was needed. Valid credentials were enough. **Mark Fermor**CTO, CMO and Founder, Firevault Published 17 August 2026 · 3 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Femployee-directories-azure-credential-theft-2026)Email A vast wall of glowing employee directory records in a dark corporate lobby, with a magenta thread pulling records away into darkness A credential theft campaign is being used to lift entire employee directories out of corporate Azure and Entra tenants, and the results are now being sold on underground forums. Cyber Security News reports that a seller using the alias TheHatman has listed data from at least nine Fortune 500-level organisations in the space of a week. ## The scale of the listings The largest listing is attributed to McDonald's Corporation at more than 1.7 million records, followed by Tata Consultancy Services at roughly 800,000, Vodafone at approximately 425,000 and HCL Technologies at around 250,000. Further listings name InterContinental Hotels Group at about 185,000, Kyndryl at 170,000, Gap Inc. at 80,000, Hexaware Technologies at 20,000 and Wyndham Hotels at 9,000. Hudson Rock researchers who reviewed sample datasets describe the material as highly credible, noting corporate email domains and field structures consistent with a standard Azure directory export. ## What the records contain Each dataset follows the same template. Names, corporate email addresses, phone numbers and physical addresses sit alongside organisational detail: employee identifiers, job titles, departments, manager assignments and direct reports. Some listings go further and include access and group mapping, service account detail, and in places the names of Global Administrator accounts. ## How the access was obtained The entry point is unconfirmed. The seller says only that compromised credentials were used. Hudson Rock reports finding Azure credentials tied to infostealer infections linked to most of the affected companies, including machines traced to employees at TCS, Gap Inc., HCL Technologies and Kyndryl, with one device holding dozens of corporate credentials and hundreds of session cookies. Other plausible routes include phishing that yielded administrative access, tenants without strict multi-factor enforcement, and third-party integrations holding overly broad read permissions. Notably, only very large multinationals appear, which points to targeted use of stolen credentials rather than a flaw in the platform itself. ## Why a directory is not a low-value loss An accurate directory is an operational asset for an attacker. Reporting lines and job titles make business email compromise convincing, because the request appears to come from the right manager to the right person. Named service accounts and administrators turn a broad estate into a short target list for initial access brokers and ransomware crews. The directory is often the map that makes the second intrusion faster than the first. ## The Firevault view Every record in these listings was reachable with a valid credential. That is the whole mechanism. Once identity is the only barrier, a stolen session cookie inherits the same reach as the employee it was taken from, and no amount of perimeter tooling changes that arithmetic. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® removes the arithmetic instead of arguing with it. Retained personnel files, HR records and organisational archives sit on hardware that is physically disconnected, so a compromised tenant credential has nothing to enumerate and nothing to export. For live operational systems, Control by Firevault keeps the route closed by default and opens it for a named person, for a defined task, then severs it again, so a stolen credential does not arrive holding an open path. Reported by Mark Fermor, drawing on Cyber Security News and Hudson Rock research. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More insight - Insight · 15 Oct 2026**CEOs now rank cyber as the top risk to growth. What should they buy first?**_Read the analysis_: https://fire-vault.com/news/kpmg-ceo-outlook-2026-cybersecurity-top-risk-to-growth - Insight · 27 Aug 2026**Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed**_Read the analysis_: https://fire-vault.com/news/manchester-airports-group-data-breach-87-million-customers-2026 - Insight · 27 Aug 2026**T-Mobile pulled the plug on Salt Typhoon. It took a car journey to get there.**_Read the analysis_: https://fire-vault.com/news/tmobile-severs-network-cable-salt-typhoon-hackers-2026 - Insight · 26 Aug 2026**Beacon breach: 1,500 charities exposed and an HIV charity's health data stolen**_Read the analysis_: https://fire-vault.com/news/beacon-charity-database-breach-hiv-charity-health-data-2026 - Insight · 23 Aug 2026**Iran-linked hackers shut down a UK power plant for four days**_Read the analysis_: https://fire-vault.com/news/iran-linked-hackers-uk-power-plant-shutdown-2026 - Insight · 22 Aug 2026**GTA 6 leaks: a nightmare or a blip for the biggest video game of the year?**_Read the analysis_: https://fire-vault.com/news/gta-6-leaks-rockstar-development-footage-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026#webpage", "url": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026", "name": "Azure credential theft campaign exposes million…", "description": "A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials,…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS", "item": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Azure credential theft campaign exposes millions of employee records at McDonald's, Vodafone and TCS", "description": "A single seller is offering internal employee directories taken from at least nine major enterprises through compromised Azure and Entra credentials, including more than 1.7 million records attributed to McDonald's. No platform vulnerability was needed. Valid credentials were enough.", "url": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/azure-credential-theft-campaign-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-08-17T08:20:00+00:00", "dateModified": "2026-10-24T15:12:46.782914+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/employee-directories-azure-credential-theft-2026" }, "inLanguage": "en-GB", "articleSection": "Insight", "wordCount": 518, "keywords": "Azure, Insight, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "A credential theft campaign is being used to lift entire employee directories out of corporate Azure and Entra tenants, and the results are now being sold on underground forums. Cyber Security News reports that a seller using the alias TheHatman has listed data from at least nine Fortune 500-level organisations in the space of a week. The scale of the listings The largest listing is attributed to ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] ```