Azure directory dumps hit McDonald's, Vodafone, TCS: millions of employee records
Actor "TheHatman" is selling employee directories from at least nine Fortune 500 firms, allegedly pulled from Azure/Entra tenants via compromised credentials. McDonald's tops the list at 1.7M+ records, followed by TCS, Vodafone, HCL, IHG, and Kyndryl. The attack vector is unconfirmed, but leaked Global Admin and service accounts map out follow-on phishing and privilege-escalation targets.