TCS Investigates Alleged Employee Data Leak Amid Underground Forum Claims Tata Consultancy Services (TCS) disclosed on Monday that it had received threat-intelligence alerts regarding a potential exposure of employee data but found no evidence of a breach in its systems or customer environments. The alert followed a post by cybersecurity firm S2W on X (formerly Twitter), which reported that a threat actor known as TheHatman had listed over 800,000 TCS employee records for sale on an underground cybercrime forum. The dataset allegedly includes names, employee IDs, email addresses, job titles, phone numbers, and physical addresses. S2W noted that the threat actor provided a sample of 6,000 records and is seeking a negotiable price for the full database. The claim suggests the data was extracted from TCS’s Azure environment using compromised credentials, though this has not been independently verified. The scale of the alleged leak raises questions, as TCS’s current workforce stands at approximately 590,000 employees far fewer than the 800,000 records claimed. In its stock exchange filing, TCS stated that the information referenced in the alerts appears to be over four years old and limited to basic employee details. The company added that it is actively monitoring its environment and will take action if new evidence emerges. The incident comes amid heightened scrutiny of TCS’s cybersecurity practices, following recent breaches involving its clients, including Jaguar Land Rover (JLR) and Marks & Spencer (M&S).

HCLTech Employee Data Allegedly Leaked in Dark Web Breach A threat actor claimed on a dark web forum to be selling a dataset allegedly belonging to HCLTech, containing details of over 250,000 employees. The exposed information reportedly includes full names, email addresses, job titles, departments, phone numbers, physical addresses, and employee and service account records. The hacker asserted that the data was obtained from a Microsoft Azure Tenant using compromised credentials, raising concerns about the growing sophistication of AI-driven cyberattacks. The incident follows a broader trend of enterprises bolstering their defenses in cloud security, AI security, and threat intelligence to counter evolving threats. HCLTech denied a breach of its internal systems, stating that its investigation found the allegedly stolen data to be limited and potentially years old, with no evidence of compromise to client engagement systems. The company confirmed that its operational systems remain unaffected and that existing safeguards implemented over two years ago remain effective. Meanwhile, TCS acknowledged receiving alerts about potential exposure of certain employee data but clarified that there was no indication of customer data or systems being impacted. The company noted that the referenced information appeared to be over four years old and limited to basic employee details. The claims were first reported by Intel and Breaches, a dark web monitoring account on X (formerly Twitter). However, the authenticity of the data dump and the threat actor’s assertions have not been independently verified. The incident underscores the persistent risks of credential-based attacks on cloud environments, particularly as cybercriminals leverage AI to automate and scale their operations. Both HCLTech and TCS continue to investigate the matter, with HCLTech stating that any material findings will be reported accordingly.

TCS Reports Alleged Exposure of Employee Data, Confirms No Customer Impact India’s largest IT services firm, Tata Consultancy Services (TCS), disclosed on August 11, 2026, that it had received alerts regarding the potential exposure of employee-related data. The company stated that the information in question appears to be over four years old and limited to basic employee details, though it did not specify the source of the alerts or the exact timeline of the incident. TCS emphasized that no customer data or operational systems were affected, and its internal safeguards implemented over two years ago remain effective against the type of attack described. The firm is actively monitoring the situation but has not provided further details on the nature of the exposure or the parties involved. The incident follows reports of an ongoing investigation by Indian authorities into a separate data leak at Tata Electronics, which allegedly exposed sensitive information related to Apple iPhone manufacturing. TCS clarified that the two incidents are unrelated.