[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGaZGR7KqAPoq-sZNDTY3GLsFflbcARLgqRlis40kd-E":3},{"article":4,"iocs":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":33,"category":34,"article_tags":38},"3500dbec-b98d-40f7-a08e-d6c1dac75666","Fortune 500 Companies Hit in Azure Data Theft Campaign","fortune-500-companies-hit-in-azure-data-theft-campaign-726199","A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations. The post Fortune 500 Companies Hit in Azure Data Theft Campaign appeared first on SecurityWeek.","A threat actor known as 'TheHatman' is reportedly selling millions of records allegedly exfiltrated from the Azure tenants of several Fortune 500 companies, including McDonald's, TCS, and Vodafone. The data, which includes employee directories, service accounts, and privileged account information, was likely obtained using leaked credentials. This exposure poses a significant risk for further social engineering, spear-phishing, and BEC attacks.","Threat actor 'TheHatman' claims to have stolen millions of records from Azure tenants of several Fortune 500 companies.","A threat actor is selling data allegedly stolen directly from the Azure tenants of several Fortune 500 organizations. Using the moniker ‘TheHatman’, the threat actor has been offering millions of records apparently stolen from well-known brands such as McDonald’s Corporation, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, InterContinental Hotels Group (IHG), Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. According to the threat actor, the data was exfiltrated from Azure\u002FEntra instances using leaked credentials. The data contains internal employee directories that, based on the identified email addresses and field names that match Azure directory exports, appear legitimate, Hudson Rock says. The McDonald’s dump is the largest, containing over 1.7 million records, followed by the TCS dataset, with 800,000 records, Vodafone with 425,000, HCL Technologies with 250,000, and IHG with 185,000. “Across all the affected tenant dumps, the leaked fields consistently include foundational corporate directory attributes,” Hudson Rock says.Advertisement. Scroll to continue reading. The exfiltrated information includes employee names, corporate email addresses, addresses, phone numbers, employee IDs, job titles, manager details, user group membership, service accounts, highly privileged account records, and more. “The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations,” Hudson Rock notes. According to the company, credentials compromised in a targeted infostealer campaign were likely used to exfiltrate the data. Not only did Hudson Rock identify stolen credentials linked to most of the affected organizations, but the victimology also suggests a targeted attack. “The campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics,” the company notes. Hudson Rock also points out that the stolen data poses an immediate threat to the victim organizations, as it allows attackers to map internal reporting structures and high-value targets, and enables them to launch convincing spear-phishing and business email compromise (BEC) attacks. Related: 1.6 Million Likely Impacted by RingCentral Data Breach Related: 14,000 Trezor Customers Impacted by Data Breach at ShipMonk Related: Trivy, Not LiteLLM Behind the 2,500 Org Compromise Related: Massive Password Spray Campaign Targeting Azure CLI Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Adobe Commerce Bug Targeted Immediately After DisclosureWordPress 7.0.4 Patches Remote Code Execution VulnerabilityFortinet Patches Authentication Flaws in FortiWeb and FortiManagerCritical VMware vCenter Vulnerability in Attackers’ CrosshairsNightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’Mindgard Raises $30 Million to Protect AI SystemsCeva Logistics Operations Disrupted by CyberattackOver 2,500 Organizations Impacted by LiteLLM Supply Chain Attack Latest News In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System VulnerabilitiesTrivy, Not LiteLLM Behind the 2,500 Org CompromiseGoogle Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal1.6 Million Likely Impacted by RingCentral Data BreachOver 1,000 Charities Hit by Beacon CRM Data Breach14,000 Trezor Customers Impacted by Data Breach at ShipMonkHackers Exploiting Unpatched GeoServer Zero-DayAmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveErika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.John Opala has joined Ralph Lauren as Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Ffortune-500-companies-hit-in-azure-data-theft-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002FMicrosoft-Azure.jpeg","2026-08-17T06:51:08+00:00","2026-08-17T08:00:24.173592+00:00",8,[18,21,24,26,29,31],{"name":19,"type":20},"TheHatman","threat_actor",{"name":22,"type":23},"Azure","product",{"name":25,"type":23},"Entra",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":28},"McDonald's Corporation",{"name":32,"type":28},"Tata Consultancy Services","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":33,"icon":35,"name":36,"slug":37},null,"Breaches","breaches",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]