Hacker Sells Data of 3.6M Employees from Major Companies via Azure

A hacker using the alias TheHatman is selling databases containing employee records from multiple major international companies, claiming the data was stolen from Microsoft Azure’s cloud infrastructure. According to the cybercriminal, the leaked records total 3.64 million, including data from employees of McDonald’s, Vodafone, Tata Consultancy Services, Gap Inc., and other corporations.

The largest breach, per the hacker, involves 1.7 million McDonald’s employee records. The databases include names, email addresses, job titles, phone numbers, postal addresses, and service/admin account credentials. TheHatman alleges the data was accessed via compromised credentials, though the exact attack vector remains undisclosed.

Companies mentioned in the hacker’s listings have responded variably to the incident. Representatives from Tata Consultancy Services stated their investigation found no evidence of a breach. They noted the leaked data is outdated and contains only basic employee information. Gap Inc. echoed this stance, asserting the data is non-sensitive and pertains to past periods.

Cybersecurity experts from Hudson Rock analyzed provided data samples and confirmed their authenticity. The leaked databases contain structured records with company domains and admin credentials, which could facilitate targeted phishing attacks. However, independent verification of the data’s authenticity has not yet been conducted.

The incident highlights vulnerabilities in corporate cloud infrastructures, particularly when weak or compromised credentials are used. Experts recommend companies enhance security measures, including multi-factor authentication and monitoring for suspicious activity in cloud environments.