TLDR Tech / InfoSec
Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records
A threat actor known as "TheHatman" is allegedly selling approximately 3.6 million internal Azure and Entra employee directories belonging to major corporations, including McDonald's, Vodafone, and Kyndryl. The exposed data includes sensitive service accounts and Global Administrator listings that match standard Azure export formats, which Hudson Rock researchers suspect stems from credential theft via infostealers. The exact intrusion vectors remain unconfirmed, and the report originates from a vendor selling credential-monitoring services, so defenders should await independent verification while actively auditing their Azure identities for compromised access.
Read the full story