Loading story…
HCLTech has disputed a threat actor’s claim that more than 250,000 employee and tenant-account records were stolen and offered for sale, saying its initial investigation found no evidence of a breach of company systems or any impact on client engagements. The company said the exposed information, if genuine, appears to be limited and several years old, and it filed a clarification with India’s National Stock Exchange and Bombay Stock Exchange while continuing its investigation.
The sale listing, posted by an actor using the alias “TheHatman,” advertised an alleged internal database supposedly obtained from an Azure tenant with compromised credentials and included a sample of roughly 7,500 records. Reported fields included names, corporate email addresses, job titles, departments, phone numbers, physical addresses, and account information, but available evidence only confirms that data is being marketed online, not that HCLTech was breached, that the dataset is authentic, or that Microsoft Azure itself was compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
HCLTech filed a formal clarification with the National Stock Exchange and Bombay Stock Exchange stating its initial investigation found the referenced data may be limited and several years old. The company said it found no evidence of a breach to its systems or any impact on client engagements and that it was continuing to investigate.
A threat actor using the alias "TheHatman" advertised an alleged internal HCLTech employee and tenant-account database for sale, claiming it was obtained from an Azure tenant using compromised credentials. The listing claimed more than 250,000 records and offered a sample of about 7,500 records.
HCLTech publicly reported having 223,000 employees as of June 30, 2026. This figure was later cited to note that the claimed 250,000-record dataset exceeded the company's stated employee headcount.
HCLTech disclosed a separate ransomware incident affecting an isolated cloud environment associated with one project. The reference notes there is no evidence linking that 2023 event to the 2026 alleged employee-data exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tata Consultancy Services (TCS) is investigating claims that a threat actor is offering more than 800,000 employee records for sale and alleging the data was taken from a TCS Azure tenant using compromised credentials. TCS said it received threat-intelligence alerts about possible exposure of internal employee information and engaged external cybersecurity specialists to review the matter. The company said it has found no credible evidence of a breach of TCS systems or customer environments, and that the exposed information appears to be more than four years old and limited to basic employee data. TCS also disputed the attacker’s claims of using password spraying and MFA fatigue, saying protections against those techniques have been in place for over two years, while independent reporting noted there is still no public proof of an Azure compromise or validation of the full dataset being advertised.
Aug 16, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
A threat actor using the alias **"TheHatman"** is advertising and selling data allegedly stolen from the Azure and Entra tenants of at least nine large enterprises, including **McDonald’s, Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies,** and **Wyndham Hotels**. The exposed datasets reportedly contain millions of records and appear to be legitimate internal employee directory exports, including employee identities, contact details, job titles, manager relationships, organizational structure, group memberships, service accounts, and in some cases **Global Administrator** or other privileged account listings. Researchers said the data samples appear credible and follow a consistent Azure directory export-like structure, increasing concern that the information was exfiltrated through compromised credentials rather than any underlying Azure platform flaw. Reporting points to a targeted credential-theft operation, with **infostealer infections**, phishing, weak MFA enforcement, or abuse of third-party API permissions cited as likely access paths; investigators also linked compromised Azure credentials tied to several affected firms. The exposure creates immediate risk of **spear-phishing, business email compromise, social engineering,** and **privilege escalation** against the impacted organizations.
Aug 17, 2026