TheHatman's 3.6M-Record Azure Haul
Palo Alto Networks Unit 42 has published a threat brief detailing a large-scale credential campaign by the actor TheHatman, who claimed to have exfiltrated 3.6 million records from nine organizations’ Microsoft Entra tenants in August 2026.
The campaign, active from August 1 through August 17, 2026, saw TheHatman post data dumps across multiple forums for sale. The largest dataset is McDonald’s, with 1.7 million records, followed by TCS at 800,000, Vodafone at 425,000, and HCL at 250,000. The remaining four organizations are IHG, Kyndryl, and Gap, the latter holding 80,000 records.
The data includes full names, email addresses, employee IDs, phone numbers, postal addresses, and service accounts. Unit 42 notes the data was allegedly exfiltrated from the organizations’ Microsoft Entra tenants, with the actor claiming access via compromised credentials through MFA fatigue and password spraying attacks.
How the Credentials Were Stolen
TheHatman claims the data was pulled from the organizations’ Microsoft Entra tenants using compromised credentials, specifically via MFA fatigue and password spraying attacks. The actor did not specify which tenants were hit first or whether the same credential set was reused across all nine organizations.
Hudson Rock, which analyzed the dumps, found infostealer-derived credentials in its database for most of the named companies. The firm said the credentials matched the Microsoft cloud accounts associated with the affected tenants, though it could not independently link those credentials to TheHatman’s initial access. Hudson Rock characterized the initial access vector as “highly likely” to be an infostealer chain rather than a zero-day, given the scale of the targets and the typical credential reuse pattern seen in infostealer harvests.
The Campaign Timeline
The campaign began on July 31, 2026, when TheHatman posted the first data dumps for sale on underground forums, starting with McDonald’s and Gap. The actor’s post for McDonald’s reads: “I’m selling McDonald’s Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials.”
From August 1 through August 17, TheHatman posted across multiple forums, offering employee data for the remaining seven organizations. Each listing included a sample database for buyers to verify the full dump. The actor claimed the data was exfiltrated directly from the organizations’ Microsoft Entra tenants using compromised credentials, specifically via MFA fatigue and password spraying attacks.
Public reporting surfaced on August 16, 2026, when the campaign was first disclosed. Palo Alto Networks Unit 42 followed with initial mitigation guidance via social media the same day, before publishing the full threat brief on August 18.
Who Was Hit
McDonald’s holds the largest dataset at 1.7 million records, followed by TCS at 800,000, Vodafone at 425,000, and HCL at 250,000. IHG and Kyndryl each account for roughly 170,000 records, while Gap Inc. closes out the list with 80,000. The seven organizations span quick-service restaurant, IT services, telecom, and hospitality, with McDonald’s and Gap as the most recognizable consumer brands in the set.
Why This Matters for Entra
Entra has become the new perimeter. Attackers no longer need to break in through a WAF or RCE; they log in with valid credentials. TheHatman’s campaign against nine organizations — McDonald’s, Gap, Vodafone, TCS, HCL, IHG, Kyndryl, and two others — is a clean example: 3.6 million records pulled directly from Microsoft Entra tenants using compromised credentials.
The initial access vector is the interesting part. TheHatman claims MFA fatigue and password spraying, which is how you beat MFA at scale. Hudson Rock’s analysis found infostealer-derived credentials in its database for most of the named companies, which is the typical pattern: infostealer harvests the cloud credentials, then the actor sprays them across the tenant. The actor didn’t specify which tenants were hit first or whether the same credential set was reused across all nine, but the scale and target mix make infostealer the most likely source rather than a zero-day.
Service accounts are what make this dangerous. The dumps include service accounts alongside the user accounts, which gives the attacker lateral movement and persistence inside the cloud tenant. Once you have a service account with Global Administrator or Directory Reader, you can enumerate the full directory, register new apps, and pivot to other tenants in the same AAD tenant. That’s the difference between a credential leak and a full tenant compromise.
Key points
- TheHatman ran the campaign from Aug 1–17, 2026, posting data dumps for nine organizations including McDonald's (1.7M records), Gap Inc. (80K), Vodafone (425K), TCS (800K), HCL (250K), IHG, and Kyndryl (170K).
- The actor claims the data was exfiltrated from Microsoft Entra tenants using compromised credentials via MFA fatigue and password spraying, though Unit 42 could not verify the specific intrusion vector.
- The data includes full names, employee IDs, email addresses, job titles, phone numbers, postal addresses, and service accounts from each tenant.
- Unit 42 published the threat brief on August 18, 2026, with initial guidance shared via social media as early as Aug 16.
- The campaign is part of a broader trend where cybercriminals log in with stolen credentials instead of exploiting a vulnerability, targeting internet-exposed services and cloud identity providers.
Further reading & sources
- Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18) — PaloAlto Networks Unit 42
- Hacker claims 3.6 million Azure account records stolen from major companies
- Crook hawks millions of records allegedly plundered from corporate Azure tenants
- TheHatman Claims 3.6M Records Linked to Azure Environments Across Nine Organizations - ThreatMon