Hacker claims to have stolen millions of Azure customer records from McDonald’s, Vodafone, Kyndryl, and others – here's what we know so far

A hacker is advertising data allegedly stolen from an array of companies including McDonald's, Vodafone, Kyndryl, and more.

Researchers at HudsonRock said that the criminal, known as TheHatman, downloaded the databases directly from the organizations’ Azure or Entra portals, claiming to have done so through the use of compromised credentials.

Other victims include HCL Technologies, IHG Hotels & Resorts, Gap, Hexaware Technologies, and Wyndham Hotels & Resorts.

"The campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics," researchers said.

"Our researchers went over the data and it seems highly legitimate based on the corporate email addresses found, combined with field names perfectly matching standard Azure directory exports."

The data – which includes roughly 3.6 million records in total – appears to include full names, corporate email addresses, including active domains and tenant-specific .onmicrosoft.com structures, phone numbers, and physical addresses.

It also covers employee IDs, job titles, departments, notes, manager details, and direct reports, along with user group memberships, service accounts, and highly privileged account records such as Global Administrator listings.

"The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations," HudsonRock said.

TheHatman's methods still unclear

Exact details on how the threat actor gained access to this trove of data remains unclear, according to researchers.

Possibilities include infostealer malware infections which compromised employee session tokens, phishing campaigns, or a lack of strict multi-factor authentication (MFA) on specific tenant portals.

Researchers also suggested it could be down to abuse of a third-party API that had excessive read privileges across multiple environments.

According to HudsonRock, the most likely explanation is a targeted exploitation of infostealer infections rather than a systemic zero-day vulnerability in Azure, as this would have hit a far broader range of victims.

Alleged victims react

Companies said to have been caught up in the breach have begun taking action.

TCS, for example, has filed a statement with India’s stock exchange, revealing that it hasn’t yet found any credible evidence of a breach of systems or customer environments.

"The information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS operational systems have been impacted," the statement reads.

ITPro approached the other aforementioned victims, but did not receive a response by time of publication.

Valuable credentials

Darren Williams, CEO and founder of BlackFog, said that if the claims are legitimate then this once again highlights the value of exposed credentials for cyber criminals.

These can often represent the keys to the castle for hackers, giving them sweeping access to enterprise environments.

“The reported use of leaked credentials to access Azure and Entra environments shows how valuable compromised identities have become to cyber criminals," he said.

"MFA, strong identity controls and employee awareness remain essential, but organizations must assume credentials can be compromised. These measures must be backed by technology that prevents sensitive data from being exfiltrated, even when attackers successfully gain access to the network.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.