A new and concerning development has emerged in the cyber underground, with a threat actor claiming to have stolen a significant volume of employee data from the **Microsoft Azure** tenants of several prominent global enterprises. Starting July 31st, an individual known as "**TheHatman**" began posting advertisements for data dumps, alleging to contain sensitive employee information from major organizations. Targeted entities reportedly include **McDonald's**, **Gap Inc.**, **Vodafone**, **Tata Consultancy Services (TCS)**, **HCL Technologies**, **InterContinental Hotels (IHG)**, and **Kyndryl**. **TheHatman** claims to possess 3.64 million data records in total, with the most recent alleged breach, posted on Sunday, involving 1.7 million employee records from **McDonald's**.  "I’m selling **McDonald’s Corporation** internal employee dump downloaded directly from Azure Tenant using compromised credentials," the threat actor stated in a post. The information purportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and other tenant account records. The second-largest advertised data dump is reportedly from **Tata Consultancy Services**, an **Azure** dump with over 800,000 employee records, also allegedly "downloaded directly from Azure Tenant using compromised credentials." ### Company Responses and Verification Efforts Despite the claims, **Tata Consultancy Services** has issued a notification to the National Stock Exchange of India, stating that an investigation found no "credible evidence of a breach of TCS systems or customer environments." The company noted that the details appear to be at least four years old and contain only basic employee information. **TCS** further emphasized that it has implemented strong safeguards against techniques like password spraying and Multi-Factor Authentication (MFA) fatigue for over two years, and a review confirmed their continued effectiveness. Similarly, a spokesperson for **Gap Inc.** informed BleepingComputer that their preliminary investigation found no evidence of a breach. They also indicated that the advertised data is non-sensitive and "dated back to several years ago," with no indication of corporate system compromise. ### Scope of the Alleged Breaches Between July 31st and August 16th, **TheHatman** has offered to sell data dumps for the following organizations, with varying record counts and data types: | Company | Size | Type | Data type | | :---------------------- | :--------------- | :------------------------- | :---------------------------------------------------- | | **McDonalds** | 1.7+ million records | Azure Internal Employee Dump | Full Name, Email, Title, Phone, Address | | **Gap Inc.** | 80,000+ records | Azure Internal Employee Dump | Full Name, Email, Title, Phone, Address | | **Vodafone** | 425,000+ records | Azure Internal Employee Dump | Full Name, Email, Title, Phone, Address | | **TCS (Tata Consultancy)** | 800,000+ records | Azure dump | Full Name, Email, Title, Phone, Address | | **HCL Technologies** | 250,000+ records | Azure dump | Full Name, Email, Title, Phone, Address | | **InterContinental Hotels** | 185,000+ records | Azure dump | Full Name, Email, Title, Phone, Address | | **Wyndham Hotels** | 9,000+ records | Azure/Entra dump | Full Name, Email, Title, Phone, Address | | **Hexaware** | 20,000+ records | Azure/Entra dump | Full Name, Email, Employee ID, Phone, Address | | **Kyndryl.com** | 170,000+ records | Azure/Entra dump | Employee accounts, service accounts, and other tenant account records. | For each advertised database, **TheHatman** has provided a sample for potential buyers to verify the data's authenticity. Cybercrime intelligence company **Hudson Rock** analyzed the leaked data, confirming that it contains "foundational corporate directory attributes" and a clear data structure, including "active domains and tenant-specific .onmicrosoft.com structures." The firm also noted the presence of service accounts and names of global administrators, which could be exploited for social engineering and spearphishing attacks. While **Hudson Rock** expresses high confidence in the data's authenticity, the exact access vector and exfiltration method remain unconfirmed. BleepingComputer has not been able to independently verify the data's authenticity. BleepingComputer has reached out to the listed companies for comment but had not received responses at the time of publication.