Summary
- TheHatman claims to be selling employee-directory datasets linked to McDonald’s, Vodafone, TCS, Kyndryl, IHG, and other large organisations.
- The claims remain unverified, but researchers have found infostealer-linked Azure credentials associated with several named companies.
- The incident focuses attention on Conditional Access, device trust, token protection, and continuous access evaluation after credentials or sessions have already been stolen.
An attacker does not need to break Microsoft Azure if the cloud environment accepts credentials or session material already stolen somewhere else.
That distinction sits at the centre of a series of alleged data dumps being advertised by a threat actor using the name TheHatman. The actor claims to have extracted millions of employee-directory records associated with organisations including McDonald’s, Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap, Hexaware, and Wyndham.
The listings are not equivalent to confirmed breaches. The named companies have not collectively validated the claims, and the precise access method remains unclear. There is currently no evidence establishing a systemic vulnerability or zero-day in Microsoft Azure or Entra as the cause.
Cybernews reviewed samples associated with several listings and reported that the advertised information included employee names, corporate email addresses, telephone numbers, job titles, and workplace addresses. The actor claims records were extracted from Azure tenants using compromised credentials.
Hudson Rock says it identified evidence connecting infostealer infections and Azure credentials associated with several of the companies, including TCS, Gap, HCL Technologies, and Kyndryl. That does not independently establish the provenance or completeness of every dataset, but it provides a plausible path that does not require a flaw in Microsoft’s cloud platform.
The compromise can happen before cloud login
Infostealers operate on endpoints rather than attacking the cloud control plane directly. Depending on the malware and environment, they can collect passwords, browser data, authentication material, and session cookies from an infected system.
If that material remains valid, subsequent access can appear to a service as an authenticated user rather than a conventional intrusion. The security decision then depends on the controls wrapped around the credential: device state, sign-in risk, token binding, session lifetime, location, continuous evaluation, and whether the identity system has learned that the account or device is compromised.
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, described the sequence as a familiar one: infostealers collect enterprise credentials, those credentials enter criminal markets, and another actor subsequently uses them against cloud environments.
“Cloud identity infrastructure is only as secure as the credentials and devices that access it,” Patel said.
His point is narrower than saying cloud identity is inherently weak. Identity platforms make decisions from the signals available to them. If a valid credential is used from a device and session that are still considered trustworthy, an attacker may not need to exploit the platform at all.
Microsoft’s own Entra documentation reflects that problem. Conditional Access can require compliant devices or additional authentication based on risk and context. Entra Identity Protection can feed risky-user and risky-sign-in signals into access decisions. Continuous Access Evaluation can enforce certain changes to user state and revoke supported sessions in near real time rather than waiting for a token to expire.
Microsoft also provides token-protection controls intended to reduce replay by binding supported sign-in tokens to the device for which they were issued.
Directory data has operational value
The records advertised by TheHatman are not being described as payment-card databases or repositories of customer passwords. That does not make the information harmless.
Corporate directories describe how an organisation is assembled. Names, titles, departments, email addresses, telephone numbers, office locations, and reporting relationships can be combined into a working map of who has authority, who works with whom, and which identities make credible impersonation targets.
Patel called the advertised data profile “a precision targeting kit for spear phishing and executive impersonation campaigns”.
A convincing social-engineering attempt rarely depends on one secret piece of information. Its effectiveness often comes from ordinary facts combined accurately: the right manager, office, colleague, project function, supplier relationship, or internal terminology.
That creates a secondary-risk problem even if compromised credentials are reset quickly. An organisation may close the original access path while the directory data remains useful to other criminals for months or years.
Identity controls have to assume credential loss
The incident therefore turns on what happens after authentication material escapes an endpoint. Password resets remain important where passwords are known to be exposed, but passwords alone are only one part of modern cloud access.
Multi-factor authentication can substantially reduce attacks based only on stolen passwords. Session theft, adversary-in-the-middle phishing, compromised endpoints, and other token-based techniques create a different problem because an attacker may attempt to reuse authentication state that has already satisfied part of the access process.
Device-compliance requirements can narrow that path by tying access to managed endpoint state. Risk-based Conditional Access can change the authentication requirement when identity signals deteriorate. Continuous Access Evaluation can shorten the period between a security event and enforcement on supported applications. Token protection seeks to make stolen session material less portable between devices.
None of those controls establishes what happened at the companies named by TheHatman. It would be irresponsible to infer missing security controls from an attacker’s sales post.
The campaign instead illustrates the architectural problem organisations are trying to solve. The endpoint, identity provider, token, device-management system, cloud tenant, and downstream applications participate in the same access decision, even though they are often managed as separate security domains.
The alleged datasets still require independent confirmation. But the absence of evidence for an Azure zero-day is itself important. A large cloud data-theft campaign can be damaging without the cloud platform being technically compromised at all. Valid access obtained through stolen identity material can be enough.
