Crook hawks millions of records allegedly plundered from corporate Azure tenants
- ID
- 14888
- Status
- summarized
- Published
- 17 Aug 2026, 7:43 PM
- Fetched
- 18 Aug 2026, 1:02 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/17/crook-hawks-millions-of-records-allegedly-plundered-from-corporate-azure-tenants/5288305
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 6.5
- Created
- 18 Aug 2026, 2:08 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
A threat actor called 'TheHatman' is selling millions of employee records allegedly exfiltrated from Microsoft Azure environments of nine major companies, including McDonald's (1.7M records), TCS (800K), Vodafone (425K), and HCL (250K). Hudson Rock assessed the data as 'highly likely authentic,' noting it contains phone numbers, physical addresses, job titles, reporting structures, group memberships, and—critically—identities of Global Administrator accounts, making it a phishing and privilege-escalation shortlist.
Why it matters
If you run Azure AD/Entra ID, this illustrates what a directory export actually leaks beyond email: org charts, service account details, and who holds Global Admin. Audit your Entra ID for infostealer-compromised credentials, enforce phishing-resistant MFA on all admin accounts, and review third-party app permissions—Hudson Rock specifically flagged overly permissive third-party apps as a likely vector. The data exposure is severe even without passwords, because knowing your Global Admins by name is enough for targeted attacks.
Discussion angle
The initial access vector is still unconfirmed—Hudson Rock found infostealer-compromised Microsoft cloud credentials for most named companies but couldn't definitively link them to TheHatman. Discuss whether your team's Azure tenant would detect a bulk directory export, and what alerting you'd need on Entra ID to catch this kind of exfiltration before the data shows up on a forum.