[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGaZGR7KqAPoq-sZNDTY3GLsFflbcARLgqRlis40kd-E":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3500dbec-b98d-40f7-a08e-d6c1dac75666","Fortune 500 Companies Hit in Azure Data Theft Campaign","fortune-500-companies-hit-in-azure-data-theft-campaign-726199","A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations. The post Fortune 500 Companies Hit in Azure Data Theft Campaign appeared first on SecurityWeek.","A threat actor known as 'TheHatman' is reportedly selling millions of records allegedly exfiltrated from the Azure tenants of several Fortune 500 companies, including McDonald's, TCS, and Vodafone. The data, which includes employee directories, service accounts, and privileged account information, was likely obtained using leaked credentials. This exposure poses a significant risk for further social engineering, spear-phishing, and BEC attacks.","Threat actor 'TheHatman' claims to have stolen millions of records from Azure tenants of several Fortune 500 companies.","https:\u002F\u002Fwww.securityweek.com\u002Ffortune-500-companies-hit-in-azure-data-theft-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002FMicrosoft-Azure.jpeg","2026-08-17T06:51:08+00:00","2026-08-17T08:00:24.173592+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"TheHatman","threat_actor",{"name":21,"type":22},"Azure","product",{"name":24,"type":22},"Entra",{"name":26,"type":27},"Microsoft","vendor",{"name":29,"type":27},"McDonald's Corporation",{"name":31,"type":27},"Tata Consultancy Services","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[26,29,31],{"controls":58,"vendors":144},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":89,"name":90,"problem":91,"products":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[93,100,108],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":89,"product_name":97,"url":98,"description":99},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":117,"name":118,"problem":119,"products":120},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[121,129,136],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":130,"vendor_name":26,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",[145],{"slug":130,"name":26,"logo_path":131,"roles":146},[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":165},"leaked-credentials-expose-fortune-500-azure-tenants-to-mass-data-theft","Leaked Credentials Expose Fortune 500 Azure Tenants to Mass Data Theft","The 'TheHatman' campaign highlights the severe downstream consequences of credential leakage in cloud environments, where a single set of compromised credentials can expose millions of sensitive records across an entire Azure tenant. Attackers leveraged leaked credentials to access employee directories, service accounts, and privileged account data — a treasure trove that dramatically lowers the barrier for follow-on attacks such as spear-phishing and Business Email Compromise (BEC). The root problem lies in inadequate credential hygiene, weak or absent multi-factor authentication (MFA), and insufficient monitoring of anomalous access patterns in cloud environments. This matters because cloud tenants often consolidate enormous volumes of sensitive organizational data, meaning a single access failure can have enterprise-wide consequences.",[153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-6 – Least Privilege","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-4 – System Monitoring","NIST CSF DE.CM-1 – Network Monitoring","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1110 – Brute Force \u002F Credential Stuffing",{}]