3.6 Million Employee Records Are For Sale And Microsoft Was Never Hacked

A threat actor going by TheHatman started posting data dumps on 31 July. The running total claimed in this Azure employee records breach is 3.64 million records, lifted from the Azure and Entra tenants of some very large organisations.

The named victims: McDonald's at over 1.7 million records, Tata Consultancy Services at around 800,000, Vodafone at around 425,000, HCL Technologies at around 250,000, plus Gap Inc, InterContinental Hotels and Kyndryl.

What is actually in the Azure employee records breach

Directory material. Names, employee IDs, email addresses, job titles, phone numbers, postal addresses and service accounts. No passwords, no card numbers, nothing that makes a dramatic headline on its own.

Which is precisely why it deserves attention. An accurate org chart, with real job titles, real reporting lines and the company's internal email format, is the raw material for a spear-phish that lands. It is the difference between a generic message from a stranger and a request from someone who knows your manager's name, your office address and the naming convention your IT team uses for service accounts.

Microsoft was never hacked

There is no Azure vulnerability here. No zero-day, no exploit chain. Researchers looking at the dumps have found no evidence of a platform flaw at all.

The credentials were stolen, largely traced back to infostealer malware sitting on employee machines, and then used to log in through the front door. Microsoft's platform did exactly what it was told by an account that looked entirely legitimate, and read the directory the way any employee could.

The chain is depressingly simple. Someone installs a cracked application or clicks a fake installer. The infostealer scrapes saved browser passwords and session cookies. Those land in a bulk log market. A buyer filters the pile for corporate domains, and walks into a cloud tenant with a valid login. No privilege escalation required, because directory read access is usually just there.

It is worth sitting with that contrast. The industry spends enormous energy on the exotic failures, the hypervisor escapes and the zero-days in security software itself. Most large breaches this year started with a password that someone had already typed correctly.

What to actually do about it

Two things, and neither is exciting.

Stop letting the browser hold your work passwords

Saved browser credentials are the first thing an infostealer takes, and session cookies are the second. Stolen cookies are the nastier half, because a live session token can walk straight past an MFA prompt that has already been satisfied. A dedicated password manager with a separate unlock is a meaningful improvement on the browser's built-in vault.

Move to MFA that a stolen password cannot defeat

Codes from an authenticator app help against credential stuffing and do nothing against a real-time phishing proxy. Hardware keys and passkeys are bound to the origin, so a fake login page cannot relay them. The YubiKey 5 NFC covers USB-A and phone taps, and the YubiKey 5C NFC is the USB-C version for newer laptops. Buy two, register both, keep one somewhere safe, because the recovery story for a single lost key is genuinely painful.

If you work at one of the named companies, assume your directory entry is circulating and treat unexpected internal requests with more suspicion than usual for the next few months. The data does not expire.

Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.