They Did Not Steal Passwords. They Stole the Map of Who to Attack Next.
An enterprise directory does not need to contain passwords to become attack infrastructure. Names, reporting lines, group memberships, service accounts and privileged identities can tell an intruder who matters, who trusts whom and where the next credential should be stolen.
A threat actor using the name TheHatman is offering datasets allegedly taken from the Microsoft Azure and Entra tenants of several large organisations. Hudson Rock says the samples it reviewed appear highly legitimate because the corporate email addresses and field names match standard directory exports.
That is important evidence, but it is not the same as independent confirmation that every named organisation was breached, that every advertised record is genuine or that Microsoft Azure itself was compromised. The actor claims the data was downloaded using compromised credentials. Hudson Rock found infostealer-linked Azure credentials associated with most of the organisations, but says the precise access path remains inconclusive.
The cautious conclusion is still serious: somebody may have obtained the organisational map that makes later phishing, impersonation and privilege targeting much more efficient.
What is claimed and what has been verified
The actor is advertising internal employee directories allegedly belonging to McDonald’s, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap, Hexaware Technologies and Wyndham Hotels.
The advertised record counts include more than 1.7 million entries for McDonald’s, about 800,000 for TCS and 425,000 for Vodafone. These are threat-actor figures. They should not be reported as confirmed affected-person totals without corroboration from the organisations concerned.
Hudson Rock’s review provides a narrower evidential base. The researchers say the samples contain corporate addresses and directory field names consistent with Azure exports. The recurring data types include:
- full names, corporate email addresses, phone numbers and physical addresses;
- employee identifiers, job titles, departments and notes;
- manager relationships and direct reports;
- group memberships;
- service-account records; and
- highly privileged identities, including accounts labelled as Global Administrators.
Hudson Rock also identified compromised Azure credentials originating from infostealer infections and linked to most of the named companies. That supports a credential-led hypothesis. It does not prove which credential accessed which tenant, whether an administrative account was involved, or whether the same technique was used in every case.
There is no published evidence here of a systemic Azure or Entra zero-day. The stronger working theory is that valid access was abused after credentials or session material were stolen.
They stole the relationship between people
A conventional breach inventory asks whether passwords, payment details or regulated personal data were taken. That framework can underestimate a directory export because its most valuable property is structure.
A manager field shows whose request is likely to be trusted. A department identifies which pretext will feel normal. Group membership reveals access boundaries. Service-account names expose machine identities that may be poorly monitored. Privileged-account records tell an attacker which people and systems deserve concentrated effort.
The data can improve several attack types:
- Executive and manager impersonation. Reporting lines make urgent requests, invoice fraud and access approvals more convincing.
- Help-desk social engineering. Job titles, phone numbers and internal naming conventions help an attacker sound like an employee who belongs.
- Spear phishing. Department, project and manager context makes generic lures specific.
- Privilege targeting. Global Administrator and service-account records shorten the search for identities that can change the whole tenant.
- Business email compromise. Organisational relationships reveal who can authorise payments and who normally receives the request.
- Password spraying and token theft. Corporate addresses provide a clean target list, while account types help attackers prioritise likely impact.
The directory is therefore not merely a contact list. It is a model of the organisation’s trust relationships.
Read access is not low impact when the directory is the target
Identity programmes often place their strongest controls around role changes, application consent and password resets. Directory read access can receive less attention because it does not alter an object.
Microsoft’s own Graph permissions reference warns that directory permissions grant broad access to users, groups, devices and applications. Directory.Read.All, for example, lets an application read directory data and requires administrator consent. Microsoft recommends using resource-specific permissions where possible rather than broad directory permissions.
The risk is not limited to one interactive user. Delegated permissions, application permissions, service principals, automation accounts and third-party integrations can all create paths to bulk directory data. A token with broad read scope may remain valuable even when it cannot change a password or assign a role.
This changes the control question. The organisation should not ask only, “Can this identity administer Entra?” It should also ask, “Can this identity export enough of Entra to make the next attack easier?”
What defenders should investigate
An incident review should begin with the boundary between the claim and the organisation’s own evidence.
- Identify bulk directory access. Review Microsoft Graph and portal activity for unusually large or repeated reads of users, groups, memberships, service principals and role assignments.
- Examine sign-in context. Correlate successful sessions with device state, IP address, geography, client application, token type, conditional-access result and normal user behaviour.
- Review downloads and export events. Microsoft Entra audit activities include bulk downloads of users, groups, group members, service principals and role assignments. Preserve and analyse those records.
- Investigate the endpoint behind a valid session. If an infostealer is plausible, resetting a password without rebuilding or cleaning the infected device can hand the replacement credential back to the attacker. Revoke sessions and tokens as part of containment.
- Audit application permissions. Inventory apps and service principals with
Directory.Read.All, broad user or group read permissions, and legacy directory roles. Confirm the owner, business purpose and last use. - Look for follow-on targeting. Monitor phishing, help-desk contacts, MFA resets, new device registrations, application-consent attempts and sign-ins aimed at privileged or service identities named in the exposed data.
- Preserve logs outside default retention. Route Entra sign-in and audit logs to a monitoring platform with retention that supports a retrospective investigation.
Reduce the value of the stolen map
An organisation cannot make every employee name secret. It can make the directory harder to export and the relationships harder to weaponise.
- Grant applications the narrowest Microsoft Graph permissions that satisfy the use case.
- Remove unused service principals, stale integrations and broad directory roles.
- Require phishing-resistant authentication for administrators and other high-value identities.
- Bind sensitive access to managed devices and appropriate conditional-access controls.
- Separate administrative identities from normal email and browsing accounts.
- Protect help-desk recovery workflows against callers who already know internal details.
- Alert on bulk directory reads and exports instead of treating them as routine administration.
- Limit public exposure of reporting lines, direct contact details and internal naming conventions where there is no business need.
- Test business email compromise procedures with scenarios that use accurate organisational context.
These controls will not make a claimed breach disappear. However, they reduce the chance that one stolen session can produce a full tenant map. They also make that map less useful as a shortcut to privilege.
Keep the uncertainty visible
The public evidence currently supports three different confidence levels.
It is confirmed that a threat actor is advertising datasets and that Hudson Rock reviewed samples with fields and addresses consistent with enterprise directory exports. It is assessed, not proven, that compromised credentials or infostealer-sourced session material enabled the access. It remains unconfirmed in the reviewed sources that every named company suffered the claimed breach and record count.
That distinction should survive the headline. Overstating the claim would weaken the analysis. Understating the exposed structure would miss the operational risk.
Passwords can be reset. An accurate map of administrators, service accounts, managers and reporting lines can be reused across many attacks. The directory was not the prelude to the breach. It may have been the objective that makes the next breach cheaper.
