Threat actor offers alleged Azure directory records from major companies

A threat actor calling itself TheHatman is offering employee-directory data allegedly taken from Microsoft Azure tenants used by several large companies, including McDonald's, Gap, Vodafone and Tata Consultancy Services. The actor claims to hold 3.64 million records and says compromised credentials enabled access. Tata and Gap said their reviews found no credible evidence that their systems were breached; both described the data as old and limited or non-sensitive. Hudson Rock said samples contained corporate-directory attributes, but BleepingComputer could not independently verify their authenticity.