Massive Employee Data Breach Allegedly Hits Microsoft Azure Customers, Including McDonald’s and Vodafone A threat actor known as TheHatman claims to have stolen millions of employee records from Microsoft Azure environments belonging to nine major corporations, including McDonald’s, Vodafone, Tata Consultancy Services (TCS), and Kyndryl. The stolen data, advertised for sale, reportedly includes 1.7 million records from McDonald’s the largest dataset alongside hundreds of thousands from other firms like HCL Technologies, IHG Hotels & Resorts, Gap, and Wyndham Hotels & Resorts. Cybersecurity firm Hudson Rock, which uncovered the breach, assessed the data as "highly likely authentic," noting that the records contain far more than basic contact details. Samples reviewed by the firm include phone numbers, physical addresses, employee IDs, job titles, department structures, office locations, and even accounts with Global Administrator privileges potentially giving attackers a roadmap for targeted phishing or privilege escalation. The method of compromise remains unclear. TheHatman claims to have used compromised credentials, but Hudson Rock could not verify the initial access vector. Possible entry points include infostealer malware, phishing, weak or missing multi-factor authentication (MFA), or overly permissive third-party applications. The firm’s analysis suggests the breach likely stems from targeted infostealer infections rather than a widespread Azure vulnerability, as the affected organizations are predominantly large enterprises. Responses from the impacted companies have been mixed. Tata Consultancy Services acknowledged receiving threat intelligence alerts about potential exposure of employee data but stated that its investigation found no evidence of a breach in its systems or customer environments. The company noted that the allegedly exposed data appears to be outdated (over four years old) and limited to basic employee information, with no impact on customer or operational systems. TCS also claimed its security controls including protections against password spraying and MFA fatigue remain effective. Microsoft and the other named organizations have not yet provided public confirmation of the breach or its scope. The full extent of the incident, including how the attacker exfiltrated data from multiple corporate Azure directories, remains under investigation.