The Hatman Heist: Massive Enterprise Data Exfiltration

Since around 31 July, a threat actor using the handle TheHatman has been posting large internal employee directories to cybercrime forums, each one advertised as having been downloaded directly from a victim company’s Microsoft Azure or Entra tenant using stolen login credentials. Cybercrime intelligence firm Hudson Rock reviewed samples of the data and published its findings on 16 August, and coverage has since spread across the security press.

Nine organisations are named across the listings, with a combined total the seller puts at roughly 3.6 million records. The scale of each individual dataset varies widely, from McDonald’s at the top down to a few thousand records for the smallest listed company.

Who’s named, and how many records

The fields reportedly included in the dumps are consistent with a standard Azure Active Directory export: full names, employee ID numbers, corporate email addresses, phone numbers, job titles, postal addresses, and in some listings, service accounts and Global Administrator entries. That last category matters more than the headline record counts — a directory that identifies which accounts hold administrative privileges gives an attacker a map for follow-on phishing rather than just a contact list.

Cybercrime intelligence firm Hudson Rock, which first reviewed the leaked samples, says it has high confidence the data itself is authentic — the field structures and domain formats match standard Azure directory exports rather than looking fabricated. What Hudson Rock has not confirmed is the access vector: how TheHatman actually got in remains unverified, and BleepingComputer notes it has not been able to independently confirm the data’s authenticity either.

How researchers say this happened

Hudson Rock’s working theory centres on infostealer malware — the kind that harvests saved passwords and active session tokens from an infected employee’s machine — which researchers say they were able to link to compromised Azure credentials tied to accounts at most of the named companies. Beyond that starting point, several routes could account for how a stolen login turned into a full directory export: phishing that yielded administrative access, tenants without strict multi-factor authentication, or a third-party integration with broader read permissions than it needed.

The pace and consistency of the postings — one directory after another, over roughly two weeks, all following the same format — points toward a repeatable process rather than a series of one-off intrusions, though the exact mechanism has not been confirmed by any of the named organisations.

Two companies dispute the claim

Tata Consultancy Services filed a notification with the National Stock Exchange of India stating it had investigated the allegation and found no credible evidence of a breach affecting TCS systems or customer environments. The company went further than a general denial: TheHatman’s listing claimed password spraying and MFA fatigue as the attack vector, and TCS stated it has had strong safeguards against both techniques in place for more than two years. TCS’s position, as reported by BleepingComputer, is that the data being circulated is at least four years old and limited to basic employee information.

Gap Inc. gave BleepingComputer a similar statement, saying its preliminary investigation found the advertised data limited in scope, non-sensitive, and dated back several years, with no evidence its corporate systems had been compromised.

McDonald’s, Vodafone and Wyndham had not issued a public response at the time this article was published, and Microsoft has not commented on the campaign. No company has confirmed a breach.

Why this matters even if some of it is exaggerated

Employee directory data doesn’t unlock a bank account, but it’s the raw material for the attacks that do. A phishing email that gets someone’s name, exact job title, direct manager and company email format right is far more convincing than a generic one — and identifying which accounts carry Global Administrator rights tells an attacker exactly who to target for maximum access if a single phish lands.

For organisations, not just the ones named, the practical response isn’t waiting to see whether this specific seller’s claims hold up. It’s the standing basics: enforcing multi-factor authentication across every Azure and Entra account without exception, auditing which third-party integrations have directory read access and scoping that down, and treating any infostealer detection on an employee device as a reason to rotate that person’s credentials immediately rather than after the fact.

My Take — Mr Wangdoo

The number that gets repeated in every headline on this — 3.6 million records — is doing a lot of work it probably shouldn’t. It’s the seller’s own claimed total, not an independently audited figure, and two of the nine named companies have already pushed back on the underlying premise. That doesn’t mean the story is nothing. Hudson Rock says the samples it reviewed carry the hallmarks of genuine Azure directory exports, and genuine or not, the method being described — credential theft feeding into automated data harvesting — is exactly the kind of low-effort, high-yield attack that keeps working because basic account hygiene keeps lagging behind it.

What I’d watch for next isn’t whether the total record count holds up. It’s whether any of the remaining seven companies follow TCS and Gap’s lead and go on the record, and whether Microsoft or any of the named organisations confirm the entry point rather than leaving it at “compromised credentials,” which currently covers everything from a phished employee to a poorly scoped API key.

Clayton Samuel (Mr Wangdoo), QFA

Founder & editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure.