Azure Data Theft Campaign Leaks Fortune 500 Entra Directories via Stolen Credentials

A threat actor operating as "TheHatman" is selling employee-directory data exfiltrated directly from the Azure and Entra ID tenants of multiple Fortune 500 companies, including McDonald's, TCS, Vodafone, HCL Technologies, and IHG. According to Hudson Rock, the data was pulled using leaked credentials rather than any software vulnerability, and the dumps look legitimate, matching the field names and formats of genuine Azure directory exports. The McDonald's dataset alone holds more than 1.7 million records. This is not a patch problem; it is an identity problem. The listings surfaced in mid-August 2026, reported by SecurityWeek.

What makes this campaign dangerous is not a clever exploit but what the stolen directories contain. Beyond names, corporate emails, phone numbers, and employee IDs, the dumps expose job titles, manager relationships, group memberships, service accounts, and the names of highly privileged and global-admin accounts. Hudson Rock flagged that last part as the real concern: exposing service accounts and global-admin identities hands an attacker a ready-made map for spear-phishing, targeted privilege escalation, and follow-on intrusion. A directory export is reconnaissance done for the adversary.

The mechanism is the ordinary tragedy of cloud identity in 2026. Infostealer malware harvests a credential or a session token from an employee's machine, and because so many tenants still allow broad directory enumeration from any device, that single foothold is enough to read the entire org chart through the Microsoft Graph API. Practitioners reacting to the leak kept returning to the same point: infostealers are now one of the top enterprise entry vectors, and a stolen session token can sail past traditional MFA and, in tenants without the right detections, run Graph and PowerShell enumeration without tripping an alarm.

How did attackers exfiltrate data from Azure and Entra ID?

Through leaked credentials and tokens, not a CVE. The reported path is credential theft (typically via infostealers) followed by directory enumeration against Entra ID, where a low-privilege account can often read thousands of user and service-principal objects by default. Because the access uses valid credentials from a legitimate session, it bypasses static authentication controls and, absent behavioral detection, blends into normal API traffic, which is why these campaigns often run quietly until the data shows up for sale. The fix is not to patch software but to close the identity gaps that let one stolen token read everything.

How do you defend an Entra tenant against this?

Assume credentials will be stolen and limit what a stolen one can do. Restrict default directory enumeration and the ability of standard users to register applications, so a single compromised account cannot map the whole tenant. Enforce Conditional Access that requires compliant or hybrid-joined devices, which keeps infostealer-harvested credentials on personal machines from reaching tenant resources. Move to phishing-resistant MFA (FIDO2, passkeys, Windows Hello for Business) and deploy token protection that binds a session to its device, neutralizing stolen cookies. Finally, alert on anomalous Graph query spikes, a single low-tier user suddenly enumerating hundreds of /users or /servicePrincipals objects, and monitor credential-broker feeds to revoke exposed tokens fast.

Our read

Understanding risk here means recognizing that the perimeter moved to identity, and most tenants have not caught up. There is nothing to patch; the exposure is a configuration and verification gap, a valid token doing exactly what the directory was willing to let it do. The organizations named here are not uniquely careless, they are typical, which is the uncomfortable part. Continuous verification of your own identity posture, who can enumerate the directory, which devices can reach it, whether sessions are bound to hardware, is the control that turns a stolen token from a full org-chart export into a dead end. Treat "we have MFA" as a claim and verify what a single stolen session can actually reach.

Reporting by SecurityWeek, citing Hudson Rock. Sources linked above.

Related: Passkey attacks that bypass phishing-resistant MFA · Azure Cosmos DB CosmosEscape and a platform-wide key