Reported by 4 outlets

Timeline

1. original reporting

   Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (Mcdonald’s, Vodafone, Kyndryl & Others)

   malware.news · 58d ago · August 16th, 2026

   Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials A significant Azure exfiltration campaign is currently underway, driven by a threat actor actively selling massive enterprise employee databases. These extensive directories were reportedly downloaded directly from the organizations’ Azure/Entra portals utilizing compromised credentials. Over the past week, a threat actor operating under the moniker “TheHatman” has flooded cybercrime forums with massive internal employee directories belonging to several Fortune 500 companies. The actor claims these dumps were extracted directly from the organizations’ Azure Tenants. A screenshot showing the extent of the threat actor’s posts on a dark web forum, listing multiple global enterprises. Affected Organizations & Scope The campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics. Our researchers went over the data and it seems highly legitimate based on the corporate email addresses found, combined with field names perfectly matching standard Azure directory exports. Here are the affected organizations and the staggering amount of records offered

2. update from gbhackers.com

   McDonald’s, Vodafone Hit in Massive Azure Credential Theft Campaign

   gbhackers.com · 58d ago · August 17th, 2026

   Recent posts on cybercrime forums advertise datasets linked to major multinational organizations, including McDonald’s, Vodafone, Tata Consultancy Services (TCS), HCL Technologies, Kyndryl, Gap Inc., InterContinental Hotels Group […] The post McDonald’s, Vodafone Hit in Massive Azure Credential Theft Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   Hackers Use Compromised Azure Credentials to Steal Millions of Enterprise Employee Records

   cyberpress.org · 57d ago · August 17th, 2026

   A large-scale Azure data exfiltration campaign is unfolding across underground forums, where a threat actor using the alias “TheHatman” is allegedly selling internal employee directories taken from major multinational organizations. The actor claims the data was extracted from compromised Microsoft Azure and Entra ID tenants using stolen corporate credentials, exposing a serious identity-security risk for enterprises reliant on cloud directory services. McDonald’s Corporation is said to account for the largest dataset, containing more than 1.7 million employee records. Hackers Use Compromised Azure Credentials Tata Consultancy Services reportedly follows with about 800,000 records, while Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels also appear in the alleged sales posts. Researchers at Hudson Rock reviewed samples from the datasets and said the information appears credible. The records reportedly include corporate email domains, tenant-specific onmicrosoft.com addresses, and fields that closely resemble those in standard Azure directory exports. The threat actor advertising 1.7 million McDonald’s employee records (Source: Hudson Rock) Rather than exposing only names and email addresses, the dumps allegedly include phone numbers, physical addresses, empl

4. mentioned by securityweek.com

   Fortune 500 Companies Hit in Azure Data Theft Campaign

   securityweek.com · 57d ago · August 17th, 2026