Overview
- A threat actor using the alias “TheHatman” has posted offers for multiple employee-directory dumps claimed to total about 3.64 million records, with the largest alleged McDonald’s file containing roughly 1.7 million entries.
- Security firm Hudson Rock says the samples contain fields and structures consistent with Microsoft Azure/Entra tenant exports and include names of service accounts and global administrators.
- The seller began offering databases on July 31 and continued listings through mid-August, with sample files provided to potential buyers to demonstrate possession.
- Several companies named by the seller, including Tata Consultancy Services and Gap Inc., have said their investigations found no evidence of current system breaches and said the material appears to be dated or limited in sensitivity.
- Researchers warn the exposed directory fields—names, emails, job titles, manager links, phone numbers and privileged account names—can be used to map internal hierarchies and stage convincing spear-phishing and business email compromise campaigns, though the full datasets and the exact exfiltration method remain unverified.