Executive Summary
A threat actor known as TheHatman is currently selling massive internal employee directories belonging to major retail entities on Breached cybercrime forum. Starting on 31 July, TheHatman advertised data dumps allegedly downloaded directly from the organizations’ Azure and Entra portals utilizing compromised credentials. The campaign impacts multiple global retail and hospitality organizations, with the threat actor claiming to possess 3.64 million data records in total. While the exact access vector remains inconclusive, cybersecurity analysts assess with stated confidence that the leaked corporate directory data is likely authentic.
Key Takeaways
- The threat actor claims to have used compromised credentials to access and download the data directly from the affected major retail entities’ Azure Tenants.
- Analysis of the leaked samples confirms they contain foundational corporate directory attributes and a clear data structure with fields perfectly matching standard Azure directory exports, including active domains and tenant-specific.onmicrosoft.com structures.
- The exfiltrated data consistently exposes core identity information, organizational structures, user group memberships, and highly privileged account records. The exposure of service accounts and global admin names is particularly concerning, as this provides a direct roadmap for subsequent social engineering, spear-phishing, or targeted privilege escalation attacks against these organizations.
- Although one affected entity investigated the alleged breach and found no credible evidence of a breach of its systems or customer environments, the company noted the attacker claimed to have used password spray and Multi-Factor Authentication fatigue as the attack vector. This mass exfiltration could be the result of active Infostealer infections compromising employee session tokens, highly successful phishing campaigns yielding administrative access, or a lack of strict Multi-Factor Authentication on specific tenant portals.
- The scale and speed of these dumps suggest a systematic, automated approach once initial access is achieved. Security researchers were able to find compromised Azure credentials originating from Infostealer infections linked to most of the affected companies. According to Hudson Rock, judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure.
Listing Sites
A collection of current listing sites by TheHatman for an affected organizations can be found below:
breached[.]st/threads/vodafone-425k-azure-internal-employee-dump-full-name-email-title-phone-address[.]86640/unread
breached[.]su/threads/tcs-tata-consultancy-800k-azure-dump-full-name-email-title-phone-address[.]90056/unread
breached[.]st/threads/hcl-technologies-250k-azure-dump-full-name-email-title-phone-address[.]86434/unread
