The threat actor 'TheHatman' is selling data allegedly stolen from Azure/Entra instances of several large enterprises, including McDonald’s, Tata Consultancy Services, Vodafone, and others. The data sets contain millions of records with corporate directory attributes such as employee names, corporate emails, phone numbers, employee IDs, job titles, manager details, user group memberships, service accounts, and highly privileged account records. The breach appears to have been enabled by leaked credentials from a targeted infostealer campaign. The compromised data allows attackers to map internal organizational structures and identify high-value targets, increasing the risk of social engineering, spear-phishing, and business email compromise attacks. The campaign affects multiple sectors including IT services, hospitality, telecommunications, retail, and logistics.

The exfiltrated data includes sensitive employee and administrative information that can be used to conduct targeted social engineering, spear-phishing, and privilege escalation attacks. Exposure of service accounts and global admin names provides attackers with a roadmap for further compromise. The data theft impacts multiple global enterprises across various industries, increasing the risk of subsequent attacks leveraging the stolen information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should verify the integrity of their Azure/Entra credentials and immediately rotate any compromised credentials. Enhanced monitoring for suspicious access and targeted phishing attempts is recommended. Implementing multi-factor authentication and reviewing privileged account access can help reduce risk. Since the data theft was enabled by leaked credentials, securing credential management and endpoint protection against infostealers is critical.