Hackers Dumping Millions Of Records From McDonald’s, Vodafone, And Other Fortune 500 Companies
A threat actor has flooded the underground forums with datasets for sale, allegedly stolen from the Microsoft Azure and Entra cloud environments of some of the world’s largest companies, exposing information that could help criminals target employees.
The attacker, going under the alias “TheHatman,” has posted data linked to at least 9 major enterprises on underground forums over the past week:
*McDonald’s Corporation: 1,700,000 records
*TCS (Tata Consultancy Services): 800,000 records
*Vodafone: 425,000 records
*HCL Technologies: 250,000 records
*InterContinental Hotels Group (IHG): 185,000 records
*Kyndryl: 170,000 records
*Gap Inc.: 80,000 records
*Hexaware Technologies: 20,000 records
*Wyndham Hotels: 9,000 records
To prove their claims, the attacker shared data samples. While the download link to McDonald’s data sample was not functional when Cybernews researchers checked, the other companies’ entries revealed what kinds of data may be included in the allegedly stolen datasets. The sample records across the listings include employee emails, phone numbers, job titles, full names, and workplace addresses.
“The impact for individuals is a heightened risk of social engineering attacks. Compromised credentials may be rotated by now, but in case it wasn’t it could be used for further data exfiltration,” said Cybernews researchers.
An attacker with accurate information about an organization’s employees, managers, departments, and reporting structures can construct highly convincing phishing messages. A criminal could, for example, impersonate an employee’s manager or an IT administrator and use real organizational details to make a request appear legitimate.
