Starting on July 31, 2026, a threat actor using the handle TheHatman began posting a steady drip of corporate employee directories to a criminal forum. By mid-August the running total reached 3.64 million records, drawn from the Microsoft Azure and Entra ID tenants of some of the largest companies on earth: McDonald’s, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels Group, Kyndryl, Hexaware and Wyndham.

There is no zero-day in this story. There is no novel exploit chain, no unpatched appliance, no clever bypass of a Microsoft security control. TheHatman logged in. That is the entire attack.

What was taken

The largest single dump is McDonald’s, at roughly 1.7 million employee records — a figure that reflects the company’s enormous global workforce and franchise footprint rather than any particular weakness on its part. Behind it:

  • Tata Consultancy Services — approximately 800,000 records
  • Vodafone — roughly 425,000 records
  • HCL Technologies — about 250,000 records
  • InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware and Wyndham — counts ranging from several thousand to more than 170,000 apiece

The record structure is consistent across the dumps, which is itself a tell: names, employee IDs, corporate email addresses, job titles, phone numbers, postal addresses, service accounts and other tenant account objects. That is the shape of a directory export — the output of enumerating a tenant’s user objects through the Entra portal or Graph API, not the output of ransacking a file share.

That distinction matters for how organizations should read the impact. This is not a dump of payroll files, health plan enrollment, or Social Security numbers. It is an org chart with contact details attached, for millions of employees, at nine companies that collectively touch retail, hospitality, telecom, IT services and quick-service restaurants.

Why an org chart is worth stealing

Security teams have a habit of triaging directory data as low severity because it contains no financial or health information. That triage is wrong, and the past two years of social engineering campaigns have proven it wrong repeatedly.

A complete employee directory is the raw material for every high-value intrusion technique currently in circulation:

Help desk impersonation. Knowing an employee’s full name, employee ID, manager, job title, office location and desk phone is precisely the verification data most IT service desks use to authenticate a caller before resetting MFA. Scattered Spider built a nine-figure crime spree on exactly this pattern, and the group’s playbook has since been copied widely enough that it is now table stakes.

Targeted phishing at scale. Job titles let an attacker sort millions of records down to the few hundred people who administer identity, finance or cloud infrastructure.

Service account discovery. TheHatman explicitly advertises service accounts in the dataset. Service accounts are the accounts most likely to be exempted from conditional access policies, most likely to hold static secrets, and least likely to be monitored for anomalous sign-ins.

Vendor pivoting. TCS, HCL, Hexaware and Kyndryl are IT service providers. Their employee directories are, functionally, a map of who holds privileged access inside their clients’ environments. A breach of an outsourcer’s directory is a breach with a blast radius measured in downstream customers.

The credential problem nobody has solved

Every published analysis of the campaign — from Cybernews, The Register, SecurityWeek and Help Net Security — converges on the same mechanism: valid credentials, used against Azure and Entra portals, to enumerate and export tenant directories.

Where those credentials came from is the part the industry keeps declining to fix. Infostealer logs are sold in bulk for single-digit dollars per machine. A corporate laptop infected through a cracked software download, a malicious browser extension or a poisoned search ad yields a browser credential store that frequently includes a live Entra session cookie alongside the password. Session cookie theft defeats MFA outright, because the authentication already happened.

Microsoft has shipped the controls that stop this. Conditional access with device compliance requirements, token protection, sign-in risk policies, and phishing-resistant authenticators all break the stolen-credential path. The controls exist. Nine Fortune 500-scale tenants apparently did not have them applied to the accounts that mattered.

The silence

As of this writing, the named companies have largely not confirmed the breaches. That silence follows a familiar pattern for directory-only incidents: because the data does not obviously trigger statutory notification thresholds in most U.S. states — no SSNs, no financial account numbers, no protected health information — there is no legal clock forcing disclosure.

Employees whose home addresses and phone numbers are now circulating on a criminal forum are unlikely to find that reasoning satisfying. Neither should boards. A directory dump is the reconnaissance phase of the next intrusion, made permanent and searchable, and the companies best positioned to warn their staff are the ones staying quiet.

What to do now

Organizations that appear in TheHatman’s postings — and organizations that do not but share the same architecture, which is nearly all of them — should treat this as an operational trigger:

  1. Audit Entra sign-in logs for directory enumeration patterns: high-volume Graph API reads of user objects, particularly from unfamiliar ASNs or unmanaged devices, going back to at least June 2026.
  2. Revoke and reissue refresh tokens for any account showing anomalous access, and enable token protection so tokens are cryptographically bound to a compliant device.
  3. Restrict directory read permissions. By default, every authenticated user in an Entra tenant can enumerate the full directory. Most organizations do not need that and can restrict it.
  4. Harden the help desk. Assume adversaries hold your org chart. Verification workflows that rely on data present in the directory are now worthless; move to callback verification, manager attestation or in-band identity proofing.
  5. Inventory service accounts for conditional access exclusions and static secrets.

Sources