Hacker Claims 3.6 Million Azure Account Records Stolen from Major Companies

Introduction

A hacker using the alias "TheHatman" claims to have stolen 3.6 million Azure account records from multiple Fortune 500 companies. The stolen data includes employee names, email addresses, job titles, phone numbers, postal addresses, and service account credentials.

This massive data breach affects major organizations including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels (IHG), and Kyndryl.

The Breach: What Happened?

Starting on July 31, 2026, the threat actor began advertising data dumps from major organizations on cybercrime forums. The hacker claims the data was "downloaded directly from Azure Tenant using compromised credentials."

Key details:

• Total records: 3.64 million employee records
• Data includes: Names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and tenant account records
• Attack method: Password spray attacks and MFA fatigue
• Data age: Some companies claim the data is at least 4 years old

Companies Affected

The hacker has advertised data dumps for the following organizations:

• McDonald's: 1.7+ million records — Azure Internal Employee Dump
• Tata Consultancy Services (TCS): 800,000+ records — Azure dump
• Vodafone: 425,000+ records — Azure Internal Employee Dump
• HCL Technologies: 250,000+ records — Azure dump
• InterContinental Hotels (IHG): 185,000+ records — Azure dump
• Kyndryl: 170,000+ records — Azure/Entra dump
• Gap Inc.: 80,000+ records — Azure Internal Employee Dump
• Hexaware: 20,000+ records — Azure/Entra dump
• Wyndham Hotels: 9,000+ records — Azure/Entra dump

McDonald's had the largest data dump, with the hacker claiming 1.7 million employee records.

How Hackers Gained Access

The threat actor claims to have used two primary attack methods:

• Password spray attacks: Attempting common passwords across thousands of accounts
• Multi-Factor Authentication (MFA) fatigue: Overwhelming users with MFA prompts until they accidentally approve one

However, some companies have disputed these claims:

• Tata Consultancy Services said it investigated and found "no credible evidence of a breach of TCS systems or customer environments." The company stated it has had strong safeguards against such techniques for more than two years.
• Gap Inc. also stated there is "no evidence to suggest that our corporate systems have been compromised" and that the data is "non-sensitive and dated back to several years ago."

Why This Matters for Your Business

Even if this data is old or non-sensitive, the breach highlights several critical issues:

• Credential theft is a major risk. Once attackers have valid credentials, they can access sensitive systems and data.
• MFA fatigue attacks are effective. Users can be overwhelmed into approving fraudulent authentication requests.
• Old data can still be valuable. Even years-old employee data can be used for social engineering and spearphishing attacks.
• Cloud environments are targets. Azure, AWS, and other cloud platforms are prime targets for attackers.
• Service accounts are high-value targets. Service accounts often have elevated permissions and are not monitored as closely as user accounts.

How to Protect Your Azure Environment

Follow these steps to secure your Azure and Microsoft 365 environment:

• Implement Conditional Access policies. Restrict access based on location, device compliance, and risk level.
• Use number matching in MFA. Instead of simple approval prompts, require users to enter a number displayed on the login screen.
• Monitor for unusual activity. Use Azure AD Identity Protection and Microsoft Sentinel to detect suspicious sign-ins.
• Review service accounts regularly. Ensure service accounts have the minimum permissions needed and are not used for interactive sign-ins.
• Implement Privileged Identity Management (PIM). Require approval for elevated access.
• Train employees on MFA fatigue attacks. Teach them to recognize and report suspicious MFA prompts.
• Regularly audit user permissions. Remove unnecessary access and enforce least-privilege principles.
• Use passwordless authentication. Consider moving to FIDO2 security keys or Windows Hello for Business.
• Monitor for compromised credentials. Use Azure AD Identity Protection to detect leaked credentials.

Final Thoughts

The alleged Azure data breach highlights the growing threat to cloud environments. Even if the data in this case is old or non-sensitive, the attack methods used — password spray and MFA fatigue — are real and effective.

Key takeaways:

• 3.6 million Azure account records allegedly stolen
• Attackers used password spray and MFA fatigue
• Data includes employee records and service accounts
• Companies dispute the severity but acknowledge the data exists
• Cloud environments must be secured with layered defenses
• MFA fatigue attacks are a growing threat

If you need help securing your Azure environment or want to learn more about protecting your business from these threats, contact SystemLogicIT for a free security assessment.