McDonald’s Azure Breach Exposes
1.7 Million Employee Records
A hacker calling himself TheHatman says he pulled 3.64 million records from 9 Fortune 500 companies, and nobody has confirmed how he got in.
A hacker calling himself TheHatman triggered a sprawling Azure breach that’s now touching nine Fortune 500 companies, and it didn’t take a zero-day to pull it off. Starting July 31, TheHatman began posting internal employee directories on cybercrime forums including DarkForum, PwnForums, and BreachForumsSt, claiming each one was pulled directly from the victim’s Azure tenant. McDonald’s tops the list with 1.7 million records, the largest single haul in the campaign so far.
Here’s what actually happened, according to researchers at Hudson Rock who reviewed sample datasets: none of this required breaking through Azure’s front door. The data is “consistent with Azure directory exports,” and the likely entry point was compromised credentials, quite possibly harvested by infostealer malware sitting on employee machines for months before anyone noticed.
This piece breaks down exactly what’s inside the leaked directories, what McDonald’s, Gap, and TCS have said in response, and what security teams running on Azure should actually be doing about it right now.
Who The Azure Breach Hit
Nine organizations across retail, IT services, telecom, hospitality, and logistics — including McDonald’s, TCS, Vodafone, and HCL Technologies.
How It Happened
Compromised Azure and Entra ID credentials, most likely harvested by infostealer malware — not a platform-wide software flaw.
Company Pushback
Gap and TCS both say they found no evidence of a breach and describe the data as old and low-sensitivity.
Why It Still Matters
Even “boring” fields like job titles and org charts give scammers exactly what they need to run convincing phishing attacks.
July 31: The Azure Breach Timeline Begins
OriginTheHatman’s first listings appeared on cybercrime forums in late July, offering internal employee data pulled from corporate Azure tenants. Each post came with a sample dataset so potential buyers could verify the goods before paying — a common tactic among data brokers trying to build credibility on underground marketplaces.
McDonald’s Tops the Azure Breach Records List
Largest HaulThe McDonald’s listing, posted around August 16, is the largest single dataset in the campaign at an estimated 1.7 million records. TheHatman described it as an “internal employee dump downloaded directly from Azure Tenant using compromised credentials,” and said it includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and other tenant account records.
Inside the Azure Breach: How Credentials Got Stolen
Root CauseSecurity researchers at Hudson Rock say they traced compromised Azure credentials linked to infostealer malware infections at several of the affected companies, including TCS, Gap, HCL Technologies, and Kyndryl. Infostealers quietly harvest saved passwords, browser data, and session cookies from an infected machine — and stolen session tokens can sometimes let an attacker skip the login screen (and MFA) entirely.
The exact entry point is still unconfirmed, but researchers point to a few likely explanations: phishing that yielded admin-level access, tenants without strict MFA enforcement, or an integration with overly broad read permissions.
Companies Respond to the Azure Breach Claims
PushbackGap told reporters its preliminary investigation found the advertised data “limited in scope, non-sensitive, and dated back several years,” with no evidence its corporate systems were compromised. TCS gave a similar statement to India’s National Stock Exchange, saying its review turned up no credible evidence of an intrusion and that the data appears to be more than four years old.
Nine companies breached the same way:
one stolen password, not one hacked system.
- Turn on phishing-resistant MFA (FIDO2 keys or passkeys) for every Entra ID account, not just admins.
- Check for infostealer exposure — run employee credentials against known infostealer and breach databases.
- Enforce Conditional Access and Continuous Access Evaluation so stolen session tokens expire faster.
- Train staff on org-chart phishing — leaked job titles and reporting lines make impersonation scams far more convincing.
- Rotate credentials for any device with a history of malware infections, even if the infection is “old.”
⚠️ Why This Azure Breach Still Matters If The Data Is “Old”
1. Org charts don’t expire. A four-year-old directory still tells a scammer who approves invoices, who reports to whom, and which employee handles vendor payments.
2. It fuels business email compromise. Attackers can use a real employee’s name, title, and workplace details to impersonate a supplier or a manager and request a fraudulent wire transfer.
3. MFA gaps outlast the leak. If credentials were reused or MFA wasn’t enforced when the data was taken, that same weakness may still exist today.