Massive Azure Breach Hits McDonald’s, Vodafone, TCS and More

{
  "signal_id": "1fee3065-79c6-1728-af95-f1227a0e9cb3",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-08-17T11:10:16+00:00",
  "company": {
    "name": "Vodafone",
    "domain": "vodafone.com"
  },
  "data": {
    "url": "https://sqmagazine.co.uk/?p=29989",
    "title": "Massive Azure Breach Hits McDonald’s, Vodafone, TCS and More - sqmagazine.co.uk",
    "excerpt": "A threat actor known as TheHatman is selling internal employee directories allegedly exfiltrated from the Azure and Entra tenants of McDonald’s, Vodafone, and seven other Fortune 500 companies, cybersecurity firm Hudson Rock reported this week. The McDonald’s dataset alone totals more than 1.7 million records. TheHatman began flooding cybercrime forums with the directories over the past week, targeting nine companies across IT services, hospitality, telecommunications, retail, and logistics. Cybersecurity firm Hudson Rock reviewed the samples and found the corporate email addresses and field names match standard Azure directory exports. The seller says every dataset was downloaded straight from the victims’ Azure and Entra tenants using stolen credentials. A massive data breach has exposed millions of records from Fortune 500 companies, including McDonald’s and Vodafone, due to compromised Azure credentials. This incident underscores the critical need for robust credential management, multi-factor authentication, and vigilant… pic.twitter.com/EQkPatzvYA McDonald’s tops the list by a wide margin. The full breakdown across all nine companies follows: TheHatman has not described the exact intrusion method beyond citing compromised credentials, and Hudson Rock calls the vector inconclusive. The access could trace to Infostealer malware harvesting session tokens, a successful...",
    "summary": "A threat actor is selling an internal employee directory allegedly exfiltrated from Vodafone's Azure and Entra tenants.",
    "planning": false,
    "image_url": "https://sqmagazine.co.uk/wp-content/uploads/2026/08/azure-data-breach-fortune-500-companies.jpg",
    "confidence": 0.9,
    "published_at": "2026-08-17T11:10:16Z",
    "vulnerability": "internal employee directory exfiltrated from Azure and Entra tenants",
    "article_sentence": "A threat actor known as TheHatman is selling internal employee directories allegedly exfiltrated from the Azure and Entra tenants of McDonald’s, Vodafone, and seven other Fortune 500 companies, cybersecurity firm Hudson Rock reported this week."
  }
}

curl https://signals.autobound.ai/v1/signals/1fee3065-79c6-1728-af95-f1227a0e9cb3 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"vodafone.com","limit":20}'