Alleged Azure credential theft exposes millions of employee records from McDonald's, Vodafone, and others

A threat actor claims to have exfiltrated millions of employee records from Azure tenants belonging to McDonald's, Vodafone, Tata Consultancy Services, and six other large enterprises. The data is being advertised for sale, with McDonald's allegedly accounting for the largest dataset at 1.7 million records. Security firm Hudson Rock assessed the data as 'highly likely authentic' based on corporate email structures and directory service exports, though no independent verification has been publicly confirmed.

The compromised records reportedly extend beyond basic contact information, including phone numbers, physical addresses, employee IDs, job titles, departments, and even service account details. Some records allegedly identify accounts with Global Administrator privileges, which could enable attackers to map organizational hierarchies and prioritize high-value targets for follow-on attacks like phishing or privilege escalation. The inclusion of such granular details suggests the data was sourced from Azure Active Directory or similar directory services.

The initial access vector remains unclear, though Hudson Rock proposed several possibilities: infostealer malware, phishing, weak or absent multifactor authentication (MFA), or overly permissive third-party applications. The attacker claims to have used compromised credentials, but no evidence directly links the breach to a specific method. Hudson Rock noted that its infostealer database contained compromised Microsoft cloud credentials for most of the named companies, though it could not tie those credentials to this specific incident.

The targeted nature of the breach, affecting only large, high-profile enterprises, suggests a deliberate campaign rather than a systemic Azure vulnerability. Hudson Rock argued that a widespread zero-day exploit would likely impact a broader range of organizations, including smaller businesses. Tata Consultancy Services stated it found no credible evidence of a breach in its systems, describing the exposed data as outdated and limited to basic employee information. However, the lack of transparency from other affected companies leaves open questions about the scope and severity of the incident.

For engineers and security teams, this incident underscores the importance of hardening Azure environments against credential-based attacks. Mitigations include enforcing MFA, monitoring for anomalous directory exports, restricting third-party application permissions, and hunting for signs of infostealer malware on employee devices. The incident also highlights the need for rapid response protocols to investigate and contain potential breaches, even when initial evidence is circumstantial.