2026 Vodafone — TheHatman Azure tenant directory sale claim (unverified; ~425K)
Data compromised
Actor-claimed ~425,000 internal employee directory records: names, corporate emails, phones, addresses, employee IDs, org structure, group memberships, service accounts — unverified
Technical writeup
Unverified forum sale claim — August 16, 2026. Hudson Rock / Infostealers documented TheHatman advertising roughly 425,000 Vodafone internal employee records allegedly extracted from an Azure/Entra tenant. Field inventory matches standard corporate directory exports (UPNs, titles, managers, privileged group listings). Vodafone had not corroborated this specific Azure-directory listing in sources reviewed at indexing. Distinct from BreachHistory's March 2026 Vodafone Lapsus$ GitHub source-code exposure row. Labeled unverified; recordsAffected uses actor/reporter count.
Root cause
Unverified cybercrime-forum sale claim: TheHatman alleges Azure/Entra employee directory exfiltration via compromised credentials — distinct from March 2026 Lapsus$ GitHub source-code dump row