A threat actor is claiming to have stolen millions of employee records from the Microsoft Azure environments of several major companies, raising concerns that the information could be used to launch targeted phishing, impersonation, and privilege escalation attacks.
The threat actor, known as “TheHatman,” has reportedly posted internal employee directories belonging to companies including McDonald’s, Vodafone, Kyndryl, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels Group, Gap, Hexaware Technologies, and Wyndham Hotels for sale on cybercrime forums.
According to various sources, samples of the data contained corporate email addresses and fields consistent with standard Azure directory exports. However, the exact method used to gain access remains unconfirmed.
Researchers said compromised credentials linked to many of the affected organisations had previously circulated following infostealer infections. Possible routes into the environments include stolen session tokens, phishing, weak MFA protections, or third-party integrations with excessive permissions.
Employee data creates a roadmap for attackers
The allegedly stolen information includes employee IDs, job titles, departments, reporting structures, group memberships, service accounts, and, in some cases, details of Global Administrator accounts.
Cian Heasley, Principal Consultant at Acumen Cyber, warned that information that initially appears relatively harmless can provide the foundations for further attacks.
“Names, job titles, phone numbers, service account labels, and global administrator identities are precisely the precursors required to build convincing spear-phishing, phone based social engineering and helpdesk request employee impersonation attacks against higher value accounts or systems,” Heasley said.
He also warned against dismissing older employee information as irrelevant.
“Enterprise org charts change slowly, service account naming conventions rarely change and historic breached data dumps can remain useful for aiding in the planning and execution of new attacks years after the original compromise took place.”
TCS has said it found no credible evidence that its systems or customer environments were breached. The company said the referenced information appeared to be more than four years old and limited to basic employee details.
Stolen credentials put cloud environments at risk
Muhammad Yahya Patel, vCISO and Cybersecurity Advisor for EMEA at Huntress, said the incident demonstrates how infostealer infections can ultimately lead to cloud compromise.
“Infostealers harvesting credentials from corporate devices, those credentials landing in criminal marketplaces, and a threat actor using them to access cloud environments that trusted those credentials without adequate verification. Same playbook. Different logos on the breach notification.”
Patel said cloud identity infrastructure is only as secure as the credentials and devices accessing it.
“Conditional access policies, continuous access evaluation, device compliance checks, and real-time credential compromise detection are the controls that close the gap between ‘credentials stolen by an infostealer’ and ‘attacker inside your cloud environment.'”
He described the employee information reportedly being sold as a “precision targeting kit” for spear phishing and executive impersonation.
Valid credentials should not mean unrestricted data access
Simon Pamplin, CTO at Certes, said the incident also raises questions about what attackers can do once legitimate credentials have been compromised.
“Stolen credentials should not automatically mean stolen data. That is the real issue with this campaign,” Pamplin said.
“The reported ability to use compromised credentials to extract huge volumes of information from enterprise cloud environments shows what can happen when successful authentication is effectively treated as permission to access and move data.”
Pamplin argued that organisations need to assume credentials will sometimes be stolen and ensure that compromising an identity does not automatically make sensitive information readable.
“Cloud security needs to separate identity from control of the data itself. Sensitive data flows should be independently encrypted, segmented and governed so that compromising an account does not provide unrestricted movement across the environment.”
The incident also carries potential supply chain implications. Heasley pointed to the presence of major IT service providers among the organisations named, warning that businesses should review which suppliers hold privileged access to their environments.
The case is also a reminder that data theft does not always arrive with a ransom demand. In this instance, the threat actor appears to be attempting to sell the information directly, meaning affected organisations may only become aware of the theft once their data surfaces on criminal forums.
