HCLTech Employee Data Allegedly Leaked in Dark Web Breach A threat actor claimed on a dark web forum to be selling a dataset allegedly belonging to HCLTech, containing details of over 250,000 employees. The exposed information reportedly includes full names, email addresses, job titles, departments, phone numbers, physical addresses, and employee and service account records. The hacker asserted that the data was obtained from a Microsoft Azure Tenant using compromised credentials, raising concerns about the growing sophistication of AI-driven cyberattacks. The incident follows a broader trend of enterprises bolstering their defenses in cloud security, AI security, and threat intelligence to counter evolving threats. HCLTech denied a breach of its internal systems, stating that its investigation found the allegedly stolen data to be limited and potentially years old, with no evidence of compromise to client engagement systems. The company confirmed that its operational systems remain unaffected and that existing safeguards implemented over two years ago remain effective. Meanwhile, TCS acknowledged receiving alerts about potential exposure of certain employee data but clarified that there was no indication of customer data or systems being impacted. The company noted that the referenced information appeared to be over four years old and limited to basic employee details. The claims were first reported by Intel and Breaches, a dark web monitoring account on X (formerly Twitter). However, the authenticity of the data dump and the threat actor’s assertions have not been independently verified. The incident underscores the persistent risks of credential-based attacks on cloud environments, particularly as cybercriminals leverage AI to automate and scale their operations. Both HCLTech and TCS continue to investigate the matter, with HCLTech stating that any material findings will be reported accordingly.

Massive Employee Data Breach Allegedly Hits Microsoft Azure Customers, Including McDonald’s and Vodafone A threat actor known as TheHatman claims to have stolen millions of employee records from Microsoft Azure environments belonging to nine major corporations, including McDonald’s, Vodafone, Tata Consultancy Services (TCS), and Kyndryl. The stolen data, advertised for sale, reportedly includes 1.7 million records from McDonald’s the largest dataset alongside hundreds of thousands from other firms like HCL Technologies, IHG Hotels & Resorts, Gap, and Wyndham Hotels & Resorts. Cybersecurity firm Hudson Rock, which uncovered the breach, assessed the data as "highly likely authentic," noting that the records contain far more than basic contact details. Samples reviewed by the firm include phone numbers, physical addresses, employee IDs, job titles, department structures, office locations, and even accounts with Global Administrator privileges potentially giving attackers a roadmap for targeted phishing or privilege escalation. The method of compromise remains unclear. TheHatman claims to have used compromised credentials, but Hudson Rock could not verify the initial access vector. Possible entry points include infostealer malware, phishing, weak or missing multi-factor authentication (MFA), or overly permissive third-party applications. The firm’s analysis suggests the breach likely stems from targeted infostealer infections rather than a widespread Azure vulnerability, as the affected organizations are predominantly large enterprises. Responses from the impacted companies have been mixed. Tata Consultancy Services acknowledged receiving threat intelligence alerts about potential exposure of employee data but stated that its investigation found no evidence of a breach in its systems or customer environments. The company noted that the allegedly exposed data appears to be outdated (over four years old) and limited to basic employee information, with no impact on customer or operational systems. TCS also claimed its security controls including protections against password spraying and MFA fatigue remain effective. Microsoft and the other named organizations have not yet provided public confirmation of the breach or its scope. The full extent of the incident, including how the attacker exfiltrated data from multiple corporate Azure directories, remains under investigation.