2026 Kyndryl — TheHatman Azure tenant directory sale claim (unverified; ~170K)
Data compromised
Actor-claimed ~170,000 employee directory records with job roles, managers, internal email structures, group mappings — unverified
Technical writeup
Unverified leak-site / forum sale claim — August 16, 2026. TheHatman's Azure exfiltration campaign listing includes Kyndryl at roughly 170,000 records. Hudson Rock published redacted samples showing detailed job roles, manager chains, and internal email attributes consistent with Entra exports, and identified infostealer-origin Azure credentials tied to Kyndryl employees in its platform — but neither confirms a direct tenant breach nor company attestation. Kyndryl had not confirmed at indexing. Labeled unverified.
Root cause
Unverified cybercrime-forum sale claim: TheHatman alleges Azure/Entra employee directory exfiltration via compromised credentials