Millions of Employee Records Stolen from McDonald's, Vodafone in Azure Breach Campaign

McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

A sprawling Azure data exfiltration campaign is unfolding across the dark web, with a threat actor systematically selling off internal employee directories stolen from some of the world’s largest corporations. The seller, operating under the alias “TheHatman,” claims to have pulled these records directly from victim organizations’ Azure and Entra tenants using compromised credentials, and the volume of data on offer is staggering. Over the past …

Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials (Mcdonald's, Vodafone, Kyndryl & Others)

Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials A significant Azure exfiltration campaign is currently underway, driven by a threat actor actively selling massive enterprise employee databases. These extensive directories were reportedly downloaded directly from the organizations’ Azure/Entra portals utilizing compromised credentials. Over the past week, a threat actor operating under the mo…