2026 McDonald's — TheHatman Azure tenant directory sale claim (unverified; ~1.7M)
Data compromised
Actor-claimed Azure/Entra directory export (~1.7M+ records): full names, corporate emails (incl. onmicrosoft.com UPNs), phone numbers, physical addresses, employee IDs, job titles, departments, manager/report mappings, group memberships, service accounts, and privileged admin listings — unverified
Technical writeup
Unverified leak-site / forum sale claim — August 16, 2026 Hudson Rock / Infostealers analysis of a multi-victim Azure exfiltration wave. Threat actor alias TheHatman is advertising internal employee directories allegedly downloaded from corporate Azure/Entra tenants using compromised credentials. McDonald's is listed at roughly 1.7 million records with samples showing DisplayName, UserPrincipalName, EmployeeId, and related directory fields. Hudson Rock researchers assessed samples as highly consistent with authentic Azure exports and noted parallel infostealer-compromised Azure credentials linked to affected firms, but the exact intrusion vector remains unconfirmed and McDonald's had not issued a matching public confirmation at indexing. BreachHistory labels the row unverified; recordsAffected reflects the actor/reporter count.
Root cause
Unverified cybercrime-forum sale claim: actor alias TheHatman alleges Azure/Entra employee directory exfiltration via compromised credentials — McDonald's had not confirmed at indexing time