Millions of employee records allegedly stolen from corporate Azure systems
Data breached from Microsoft Azure environments reportedly up for sale on dark web.
1Large-scale data breach claim
According to Hudson Rock's report, a hacker named 'TheHatman' claims to have stolen millions of employee records from Microsoft Azure systems of 9 major companies. The largest dataset allegedly belongs to McDonald's with 1.7 million records. Reports indicate 800,000 records from Tata Consultancy Services, 425,000 from Vodafone, and 250,000 from HCL Technologies. Strong evidence suggests the data was taken from Microsoft Azure directory services.
2Sensitive information exposed
The stolen records reportedly contain more than just names and work emails, including phone numbers, physical addresses, employee IDs, job titles, and department details. Some records allegedly identify accounts with Global Administrator privileges, creating a valuable target list for cyber attackers. This information could significantly facilitate sophisticated phishing campaigns against the affected organizations.
3Breach method remains unclear
How TheHatman accessed the data is still uncertain. While the attacker claims to have used compromised credentials, Hudson Rock couldn't verify the initial access vector. Possible methods include stolen session cookies via infostealer malware, phishing attacks, weak multi-factor authentication, or overly permissive third-party applications. The exact breach vector requires further investigation.
4Official responses from companies
Tata Consultancy Services stated in a stock exchange filing that no security breach was detected in their systems. The company emphasized that the allegedly leaked data appears to be over four years old and limited to basic employee information. TCS noted having strong safeguards against such attacks for more than two years and confirmed their controls remain effective.
5Industry-wide implications
The attack specifically targeting Fortune 500-level companies suggests this stems from targeted infostealer infections rather than a systemic Azure vulnerability. Hudson Rock notes that a widespread vulnerability would likely affect smaller businesses too. This incident highlights the need for large corporations to reevaluate their cybersecurity policies, particularly regarding cloud access management.
6Microsoft's position
Microsoft hasn't issued an official statement yet. It remains unclear whether the company is aware of a broader campaign targeting Azure or Entra customers. Microsoft's historical response to similar data breach allegations recalls its commitments to cloud security, but current silence leaves questions unanswered about potential platform vulnerabilities.
7Cybersecurity experts warn
Experts emphasize that employees of affected companies should be vigilant against phishing attempts following the dark web sales of stolen data. The exposure of Global Administrator account details particularly increases the risk of secondary attacks against corporate networks. This incident reinforces the critical importance of robust multi-factor authentication systems across all enterprise accounts.
8Critical lessons for corporate security
This event demonstrates that large-scale corporate data breaches remain a persistent threat. Companies must tighten access controls in cloud environments, review third-party application permissions, and enhance employee training. Reducing detection times for data breaches and maintaining transparent communication are crucial to preventing loss of trust in an organization's security posture.