TheHatman Takes His Hat — and 3.6 Million Employee Records

A threat actor operating under the alias “TheHatman” claims to have quietly siphoned millions of employee records out of the Azure cloud environments belonging to several Fortune 500 companies

The actor has been posting large internal employee directories on cybercrime forums, naming nine victims: McDonald’s, Vodafone, Kyndryl, Tata Consultancy Services (TCS), HCL Technologies, InterContinental Hotels Group (IHG), Gap Inc., Hexaware Technologies, and Wyndham Hotels.

According to cybersecurity firm Hudson Rock, a threat actor going by the alias TheHatman has been offering internal employee directories allegedly pulled from the Microsoft Azure and Entra environments of nine global companies — using stolen credentials to walk in the front door.

Altogether, the threat actor claims to be holding more than 3.6 million records. 

McDonald’s tops the list at over 1.7 million, followed by TCS at more than 800,000 and Vodafone at roughly 425,000. 

Each posted dataset reportedly contains employee IDs, job titles, departments, manager and direct-report relationships, group memberships, service accounts, and in some cases the names of accounts holding Global Administrator privileges.

TCS, for its part, responded. In a filing with the BSE, the company said the employee data referenced in the alert is four years old — without confirming its exact age or how it was obtained. 

In a blogpost, Hudson Rock stated, “While we don’t have definitive confirmation as to which specific credentials were used to hack these organizations, Hudson Rock researchers were able to find compromised Azure credentials originating from Infostealer infections linked to most of the affected companies.

Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure. If this were a widespread vulnerability, we would likely see a much broader spectrum of organizations impacted, including smaller businesses, rather than just these massive Fortune 500-level enterprises.”