Fortune 500 Companies Hit in Azure Data Theft Campaign

Overview

A threat actor operating under the alias "TheHatman" is flooding cybercrime underground forums with massive internal employee directories stolen from some of the world's largest enterprises. Researchers at Hudson Rock and infostealers.com first reported the campaign on August 16, 2026, and it is continuing to develop. The datasets, which security researchers have assessed as "highly legitimate," were extracted from victims' Microsoft Azure / Entra ID tenants using compromised credentials obtained through infostealer malware — not a zero-day vulnerability in the Azure platform itself.

Affected Organizations

Total estimated exposure: 3.5 million+ enterprise employee records

Not all named organizations have publicly confirmed a breach as of publication.

How the Attack Works

This campaign exploits the gap between endpoint security and cloud identity management, not a flaw in Azure itself. The attack chain is straightforward:

1. Infostealer malware infects employee endpoints — Hudson Rock confirmed infostealer-linked credential exposure at TCS, Gap Inc., HCL Technologies, and Kyndryl. One compromised Kyndryl-linked machine reportedly held dozens of corporate credentials and hundreds of session cookies.

2. Credentials and session tokens are harvested from infected machines — these are live Entra ID (Azure Active Directory) authentication artifacts, not hashed passwords.

3. The attacker authenticates to the Azure/Entra portal using stolen credentials, appearing as a legitimate user to Microsoft's systems.

4. Bulk directory export is performed using native Microsoft Entra ID administrative functionality — there is no exploitation of a software vulnerability in this step. The attacker simply uses what the platform provides.

5. Data is packaged and listed for sale on underground cybercrime forums.

The targeting of exclusively large multinational enterprises, rather than a broad mix of company sizes, suggests deliberate reconnaissance to identify high-value targets rather than opportunistic scanning.

What Data Was Stolen

The leaked datasets contain standard Microsoft Entra ID directory export fields:

• Corporate email addresses
• Full legal names and display names
• Phone numbers (office and mobile)
• Physical office addresses
• onmicrosoft.com tenant domain identifiers
• Organizational hierarchy data (manager/department fields)

Researchers reviewing sample records describe the structure as precisely matching standard Azure Entra ID exports, lending credibility to the legitimacy claims.

Why This Matters

The stolen directories are premium raw material for downstream attacks:

• Business Email Compromise (BEC): Accurate org charts enable targeted impersonation of executives and finance staff
• Spear phishing: Full name, role, phone, and email data enables highly personalized lures
• Account takeover: Combined with other leaked credentials, directory data fills in gaps for credential-stuffing attacks
• Initial access brokering: Directories can be sold to ransomware operators identifying privileged accounts to target
• Social engineering: Accurate internal structure data makes impersonation of IT staff far more convincing

Mitigations

The attack vector is infostealer-driven credential compromise — not an Azure platform vulnerability. Defenses focus on endpoint hygiene and identity monitoring:

Identity and Access

• Enforce MFA across all Azure/Entra tenant portals — this is table stakes, not optional
• Revoke active sessions and tokens immediately when an infostealer infection is confirmed; password resets alone are insufficient when session tokens have already been harvested
• Rotate all credentials associated with any confirmed infostealer infection on any device
• Restrict and audit bulk Entra ID directory export permissions — limit who can perform full directory exports to a minimal set of named administrators

Threat Intelligence

• Subscribe to infostealer credential monitoring feeds (Hudson Rock, KELA, Flashpoint) to receive alerts when your organization's credentials surface in stealer logs
• Correlate infostealer exposure alerts with Entra ID sign-in logs — do not treat a compromised endpoint as an isolated event; assume all credentials on that machine are compromised

Conditional Access

• Require compliant/managed devices for Entra portal access via Conditional Access policies
• Monitor Microsoft Graph API calls for anomalous enumeration patterns (unusually high user listing calls)
• Enable Entra ID Identity Protection and triage risky sign-in alerts promptly

Context: Storm-2949

This campaign follows a related Azure identity attack pattern. In May 2026, Microsoft disclosed Storm-2949, a threat group that compromised cloud tenants through social engineering of Self-Service Password Reset (SSPR) flows — calling victims impersonating IT support to approve MFA prompts. That campaign exfiltrated from OneDrive, SharePoint, Azure Key Vaults, and SQL databases. While distinct from TheHatman's infostealer-based approach, both campaigns highlight the same fundamental risk: once an attacker has valid Entra ID credentials, native Azure functionality becomes the exfiltration mechanism.

Sources

• Hudson Rock — Massive Azure Exfiltration Campaign
• Infostealers.com — Campaign Report
• CyberSecurityNews — McDonald's, Vodafone Hit
• Microsoft Security Blog — Storm-2949