Hacker puts 3.6 million employee records from Fortune 500 Azure infrastructure up for sale

An unknown individual operating under the handle TheHatman has, since July 31, been posting ads offering databases of employees from major corporations for sale. According to the seller, the information was exported directly from Microsoft Azure tenants after gaining access to compromised accounts. In all, some 3.64 million records are on offer.

The list of affected organizations includes McDonald's, Gap Inc., Vodafone, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels (IHG), Wyndham Hotels, Hexaware and Kyndryl. The most recent and largest leak concerns McDonald's — reportedly 1.7 million records: names, employee IDs, email addresses, job titles, phone numbers, mailing addresses, as well as service accounts and other tenant credentials. The second-largest dump is attributed to TCS — more than 800,000 records.

The companies deny any breach

Not all of the named parties agree with the hacker's account. In a filing with the National Stock Exchange of India, TCS stated that it had carried out an investigation and found no “credible evidence of a compromise of the company's systems or client environments.” According to the corporation, the data dates back at least four years and contains only basic employee information. The attacker, TCS said, claimed to have used password spray and MFA fatigue techniques, yet the company has had protections against such methods in place for over two years.

Gap Inc. likewise told BleepingComputer that it had found no signs of a breach: on a preliminary assessment, the data offered for sale is “limited in scope, not sensitive, and relates to past years.”

What the researchers say

Hudson Rock, a firm specializing in cyber intelligence, examined the samples and confirmed that the dumps contain “basic corporate directory attributes” with a clear field structure, including active domains and tenant-specific constructs of the form .onmicrosoft.com. Of particular concern is the presence of service accounts and the names of global administrators — such details make targeted phishing attacks and social engineering easier.

Hudson Rock considers the data authentic with a high degree of confidence, though the exact access vector and method of exfiltration remain unknown. For each database, TheHatman includes a sample so that buyers can verify the contents. The publication was unable to independently confirm the authenticity of the data, and inquiries sent to the listed companies had gone unanswered as of the time of publication.

Source: Bleeping Computer