2026 McDonald's — TheHatman Azure tenant directory sale claim (unverified; ~1.7M)
Data compromised
Actor-claimed Azure/Entra directory export (~1.7M+ records): full names, corporate emails (incl. onmicrosoft.com UPNs), phone numbers, physical addresses, employee IDs, job titles, departments, manager/report mappings, group memberships, service accounts, and privileged admin listings — unverified
Technical writeup
Unverified leak-site / forum sale claim — August 16–17, 2026. Hudson Rock / Infostealers and BleepingComputer documented TheHatman advertising internal employee directories allegedly downloaded from corporate Azure/Entra tenants using compromised credentials. Campaign total claimed ~3.64 million records (posts from 31 July–16 August). McDonald’s is the largest listing at roughly 1.7 million records (names, emails, titles, phones, addresses, employee IDs, service accounts). Hudson Rock assessed samples as highly consistent with authentic Azure exports; BleepingComputer did not independently verify authenticity. McDonald’s had not issued a matching public confirmation at indexing. TCS and Gap later denied current systems breaches for their listings. BreachHistory labels the McDonald’s row unverified; recordsAffected reflects the actor/reporter count.
Root cause
Unverified cybercrime-forum sale claim: actor alias TheHatman alleges Azure/Entra employee directory exfiltration via compromised credentials — McDonald's had not confirmed at indexing time