Azure Directory Leak: Why Your Org Chart Is a Target

By Yonatan Hoorizadeh, CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: August 18, 2026

Last updated: August 18, 2026

A threat actor using the alias TheHatman is selling 3.64 million employee records allegedly pulled from the Microsoft Azure and Entra tenants of nine large companies. No customer data was taken. The stolen directories still hand attackers reporting lines, service account names, and global administrator names, which is the raw material for business email compromise.

What happened in the Azure directory leak?

Starting July 31, 2026, a threat actor using the alias TheHatman began advertising internal employee directories on cybercrime forums, claiming each was pulled straight from the victim organization's Microsoft Azure tenant. BleepingComputer reported the actor claims 3.64 million records across nine organizations. Cybercrime intelligence firm Hudson Rock reviewed samples and found field names and corporate email addresses consistent with a standard Azure directory export.

The named organizations are McDonald's Corporation, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, InterContinental Hotels Group (IHG), Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. McDonald's is the largest listing at more than 1.7 million records, followed by TCS at more than 800,000 and Vodafone at more than 425,000, according to BleepingComputer's tally of the forum posts.

The contents go well past a contact list. Hudson Rock reported that the dumps include employee IDs, job titles, departments, manager and direct-report relationships, group memberships, service accounts, and in some cases the names of accounts holding Global Administrator privileges in Microsoft Entra ID, the identity service formerly called Azure Active Directory.

Two of the named companies pushed back publicly. TCS filed a statement with the Bombay Stock Exchange on August 10 saying it "has not found any credible evidence of a breach" of its own systems or customer environments, adding that the referenced data appears to be more than four years old. A Gap Inc. spokesperson told BleepingComputer the advertised data is "limited in scope, non-sensitive and dated back to several years ago."

Why does a stolen employee directory matter if no customer data was taken?

A corporate directory is targeting data. It tells an attacker who approves payments, who reports to whom, which accounts belong to machines rather than people, and which humans hold administrative rights. Hudson Rock described the exposure of service accounts and global administrator names as a direct roadmap for social engineering, spear-phishing, and targeted privilege escalation against the named companies.

Business email compromise is the attack class this feeds. A fraudulent payment request that names the actual controller, references the actual approval chain, and arrives from an address matching your real email format does not read as phishing. It reads as Tuesday. The FBI's Internet Crime Complaint Center has spent years reporting BEC as one of the costliest categories of reported cybercrime, and the constraint on it has always been the attacker's knowledge of the target, not their technical skill.

Here is what makes this event awkward for a leadership team: nothing about it triggers. There is no encryption, no ransom note, no downtime, no outage bridge. Under most state breach notification statutes, including California's, the clock starts when a name is exposed alongside a specified element such as a Social Security number, driver's license number, or financial account number. A directory of names, work emails, and job titles usually does not clear that bar.

So no notification obligation fires, no regulator gets a filing, no insurance claim opens, and no incident response plan activates. The exposure sits quietly for months. The invoice arrives later.

The "this data is four years old" defense misses the point

Age destroys the value of credentials quickly. It barely touches the value of an org chart. Reporting structures, department names, email formats, and service account naming conventions are among the most stable data any company holds. A four-year-old directory still tells an attacker how your service accounts are named and who sits above whom, which is exactly what makes a pretext believable.

TCS and Gap Inc. may well be right on the facts. Both statements can be true at once: no attacker touched their production systems, and data describing their people is now circulating with buyers attached. Those are different findings with different owners. The first belongs to IT. The second is a standing fraud exposure that outlives the news cycle by years, and no one in a typical company is assigned to it.

That gap between "our systems were not compromised" and "our people are now easier to impersonate" is where most boards stop asking questions. It is also where the loss actually happens.

How did attackers get directory-level access?

Nobody has confirmed the intrusion vector. Hudson Rock stated the data is highly likely authentic while noting the campaign method is not conclusive, and listed several possibilities: infostealer malware capturing live session tokens, phishing that yielded administrative access, missing multi-factor authentication on specific tenant portals, and abuse of a third-party integration holding excessive read privileges across environments. TCS reported that the attacker claimed password spray and MFA fatigue as the vector.

Hudson Rock's assessment is that the campaign most likely traces to targeted exploitation of infostealer infections rather than a flaw in Azure itself, reasoning that a platform-level vulnerability would have swept up small businesses too, not just Fortune 500-scale enterprises.

This next part deserves attention from anyone running Microsoft 365, and it is largely missing from the coverage. Reading the directory is not a privileged action by default. In Microsoft Entra ID, ordinary member accounts can read most directory objects, including users, groups, and memberships. The tenant setting that restricts access to the Entra admin center blocks the portal view, not programmatic reads through the Microsoft Graph API. One compromised salesperson's session token can be enough to export the entire org chart without ever touching an admin account.

What should your company do?

Three questions carry most of the value: who can read your directory and through which paths, is there evidence someone already did, and what cuts the fraud path this data enables. None of it requires new tooling, and all of it can be answered from configuration and logs you already own.

• Inventory the enterprise applications and third-party integrations in Entra ID holding Directory.Read.All or User.Read.All consent. Revoke consent for anything with no named business owner. Hudson Rock listed excessive third-party read privileges as a plausible vector, and it is the fastest one to rule out in your own tenant.

• Pull 90 days of Entra sign-in logs, including non-interactive sign-ins, and hunt for bulk directory reads through Microsoft Graph. Enumeration has a shape: one account or application pulling large volumes of user objects in a short window, usually from an IP or app with no history in your tenant.

• Check your email domains against infostealer exposure data. Hudson Rock noted that compromised Microsoft cloud credentials tied to most of the named companies were already circulating from infostealer infections.

• Require compliant or hybrid-joined devices in Conditional Access for anything touching Entra, and turn on token protection where your licensing supports it. Stolen session cookies walk past MFA because MFA already succeeded. Binding the session to a known device is what breaks the replay.

• Brief finance and accounts payable directly. Any payment change, vendor banking update, or urgent executive request gets verified on a phone number you already had, no matter how much correct internal detail the sender includes. Knowing the CFO's name is no longer evidence of anything.

• Read your cyber policy and your incident response retainer against this specific scenario. Many policies key coverage off a security breach of your own network. Data theft from a cloud tenant with no confirmed compromise of your systems may not qualify, and the time to learn that is not during a wire fraud investigation.

When Purple Shield runs this review for a client, identity configuration and log evidence come first, before any conversation about products. The work is narrow enough that a fractional CISO can close it in days rather than quarters, because every question above has a definite answer sitting in a tenant setting or a log query.

Frequently asked questions

Was Microsoft Azure itself breached?

No evidence points to a flaw in Microsoft Azure or Microsoft Entra ID. Hudson Rock assessed that the campaign most likely originates from infostealer infections on individual accounts rather than a systemic vulnerability, reasoning that a platform-level bug would have produced victims across companies of every size. As of August 18, 2026, Microsoft has not published an advisory tied to this campaign.

Do we have to notify employees if our directory is leaked?

Usually not under state breach notification law, which typically requires a name paired with a sensitive element such as a Social Security number, driver's license number, or financial account number. Names, titles, and work emails rarely clear that threshold. Confirm the answer with your counsel, because the statutes vary. Whether you should tell staff anyway is a separate question, and the answer is often yes, since they are the ones who will receive the resulting phishing.

How would we know if someone exported our Entra ID directory?

Microsoft Entra sign-in logs and audit logs capture directory reads, including non-interactive sign-ins and Microsoft Graph API calls. Look for bulk enumeration: a single account or application pulling a large number of user objects in a compressed time window, typically from an IP address or application with no prior history in the tenant. Default log retention in Entra ID is short, so anything beyond that window has to come from your SIEM or log archive.

Does MFA stop this kind of theft?

MFA raises the cost but does not close the path. When infostealer malware lifts a live session token from an already-authenticated browser, the attacker replays a session that has satisfied MFA. Controls that bind the session to a known device, such as Conditional Access compliant-device requirements and token protection, are what break the replay. MFA fatigue attacks, which TCS said the actor claimed to use, work around the prompt rather than through it.

We are a 200-person company, not a Fortune 500. Does this apply?

The technique scales with how easy your directory is to read, not with your revenue. A 200-person org chart is arguably more useful to a fraudster, because it is small enough to work from end to end and every name in it is plausible to every employee. If you run Microsoft 365 and have ever granted a third-party application directory read access, you carry the same exposure with far less monitoring behind it.

Where this leaves you

If you cannot say today who can read your directory, which third-party applications hold that access, or whether your logs would show a bulk export, those are answerable questions with a fixed scope. Purple Shield's cloud security consulting covers exactly that kind of identity and configuration review across Microsoft 365 and Azure environments, and the output is a list of settings and log findings rather than a product recommendation. If it would help to have a second set of eyes on your tenant before someone else does the reading, that is a conversation worth having.