--- title: Hacker claims 3.6 million Azure account records stolen... description: A threat actor known as TheHatman is selling employee data allegedly stolen from the Microsoft Azure tenants of multiple Fortune 500 companies, including... canonical: https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hacker claims 3.6 million Azure account records stolen from major companies | daily.dev og:description: A threat actor known as TheHatman is selling employee data allegedly stolen from the Microsoft Azure tenants of multiple Fortune 500 companies, including... og:url: https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe og:image: https://api.daily.dev/og/posts/HtudVcxqe.png og:image:alt: Hacker claims 3.6 million Azure account records stolen from major companies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hacker claims 3.6 million Azure account records stolen from major companies **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary A threat actor known as TheHatman is selling employee data allegedly stolen from the Microsoft Azure tenants of multiple Fortune 500 companies, including McDonald's, Vodafone, Tata Consultancy Services, HCL Technologies, IHG, Gap Inc., and Kyndryl, claiming a combined 3.64 million records obtained via compromised credentials. The seller says techniques included password spraying and MFA fatigue. Tata and Gap Inc. have denied evidence of a breach, stating the data is old and non-sensitive. Cybercrime intelligence firm Hudson Rock says the leaked samples appear authentic and contain corporate directory data, service accounts, and admin names that could enable spearphishing, though the exact access and exfiltration method remains unconfirmed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What attack techniques were used in the alleged Azure data breaches affecting companies like Tata Consultancy Services? The attacker claimed to have used password spraying and MFA fatigue attacks to gain access using compromised credentials, then downloaded employee data directly from Azure tenants. Tata Consultancy Services stated it has had strong safeguards against these specific techniques in place for more than two years and found no credible evidence of an actual systems breach. _Security teams tracking credential-based Azure attacks can follow real-world incident details on daily.dev._ ### What kind of data was allegedly stolen in the McDonald's Azure breach claim? A threat actor using the alias TheHatman claimed to have stolen 1.7 million McDonald's employee records directly from an Azure tenant using compromised credentials. The data reportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, and service account information. _Follow evolving enterprise data breach disclosures like this one on daily.dev._ ## Similar posts on daily.dev - [Accenture confirms breach after hacker offers stolen data for sale](https://daily.dev/posts/accenture-confirms-breach-after-hacker-offers-stolen-data-for-sale-nsjor076e) · BleepingComputer · 1 upvotes · 0 comments - [One criminal stole info from 50 orgs thanks to no MFA](https://daily.dev/posts/one-criminal-stole-info-from-50-orgs-thanks-to-no-mfa-h2ehlpe08) · The Register · 0 upvotes · 0 comments - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft 365 users fall victim to one-in-a-million password spray attack](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#azure](https://daily.dev/tags/azure), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hacker claims 3.6 million Azure account records stolen from major companies","url":"https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe"},"datePublished":"2026-08-17T19:36:36.188Z","dateModified":"2026-08-18T18:06:02.136Z","description":"A threat actor known as TheHatman is selling employee data allegedly stolen from the Microsoft Azure tenants of multiple Fortune 500 companies, including...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d433323e3df5720669e9f52a202e3a6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3d433323e3df5720669e9f52a202e3a6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,azure,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hacker claims 3.6 million Azure account records stolen from major companies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hacker-claims-3-6-million-azure-account-records-stolen-from-major-companies-htudvcxqe#faq","mainEntity":[{"@type":"Question","name":"What attack techniques were used in the alleged Azure data breaches affecting companies like Tata Consultancy Services?","acceptedAnswer":{"@type":"Answer","text":"The attacker claimed to have used password spraying and MFA fatigue attacks to gain access using compromised credentials, then downloaded employee data directly from Azure tenants. Tata Consultancy Services stated it has had strong safeguards against these specific techniques in place for more than two years and found no credible evidence of an actual systems breach. Security teams tracking credential-based Azure attacks can follow real-world incident details on daily.dev."}},{"@type":"Question","name":"What kind of data was allegedly stolen in the McDonald's Azure breach claim?","acceptedAnswer":{"@type":"Answer","text":"A threat actor using the alias TheHatman claimed to have stolen 1.7 million McDonald's employee records directly from an Azure tenant using compromised credentials. The data reportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, and service account information. Follow evolving enterprise data breach disclosures like this one on daily.dev."}}]} ```