A threat actor using the alias “TheHatman” is advertising large employee datasets allegedly stolen from the Azure/Entra tenants of at least nine (9) major enterprises, including McDonald’s, Vodafone, Tata Consultancy Services, Gap, HCL, IHG, Kyndryl, Hexaware, and Wyndham. The dumps reportedly total about 3.64 million records and contain corporate directory-style data such as names, emails, phone numbers, job titles, workplace addresses, employee IDs, departments, service accounts, and even Global Administrator listings. Cybercrime researchers say the data structure is consistent with Azure directory exports and is “highly likely authentic,” and links some of the compromised Azure credentials to infostealer malware infections rather than any Azure zero day. TheHatman claims to have used password spraying and MFA fatigue attacks with stolen credentials. Several companies, including TCS and Gap, say the data appears to be older, basic employee information and that they’ve found no evidence of current system breaches. Even if dated, however, the exposed directory data significantly increases the risk of targeted phishing and impersonation attacks against employees at these firms with data exposed.