Loading story…
Tata Consultancy Services (TCS) is investigating claims that a threat actor is offering more than 800,000 employee records for sale and alleging the data was taken from a TCS Azure tenant using compromised credentials. TCS said it received threat-intelligence alerts about possible exposure of internal employee information and engaged external cybersecurity specialists to review the matter.
The company said it has found no credible evidence of a breach of TCS systems or customer environments, and that the exposed information appears to be more than four years old and limited to basic employee data. TCS also disputed the attacker’s claims of using password spraying and MFA fatigue, saying protections against those techniques have been in place for over two years, while independent reporting noted there is still no public proof of an Azure compromise or validation of the full dataset being advertised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On August 10, TCS said it had received threat-intelligence alerts alleging possible exposure of certain employee-related information. The company began assessing the issue and later said the referenced data appeared to be old and limited in scope.
Hudson Rock reported on August 16, 2026 that a threat actor using the alias "TheHatman" was allegedly exfiltrating internal employee directory data from Azure/Microsoft Entra tenants at multiple large enterprises, including TCS, McDonald’s, Vodafone, HCL Technologies, IHG, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. The report said compromised Azure credentials tied to infostealer infections were identified for most affected companies and described the activity as an active campaign.
TCS disclosed the matter in a filing with the Bombay Stock Exchange and said it was investigating with support from external cybersecurity specialists. The company said it found no credible evidence of a breach of TCS systems or customer environments, and no indication that customer data or operational systems were affected.
A threat actor posted an alleged Tata Consultancy Services dataset for sale on a criminal forum, claiming it contained more than 800,000 records and had been taken from a TCS Azure tenant using compromised credentials. The seller also offered a sample of about 6,000 records as proof of possession.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecyberveille.ch
Open sourceteiss.co.uk
Open sourcethecybersecguru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HCLTech has disputed a threat actor’s claim that more than 250,000 employee and tenant-account records were stolen and offered for sale, saying its initial investigation found **no evidence of a breach** of company systems or any impact on client engagements. The company said the exposed information, if genuine, appears to be **limited and several years old**, and it filed a clarification with India’s National Stock Exchange and Bombay Stock Exchange while continuing its investigation. The sale listing, posted by an actor using the alias **“TheHatman,”** advertised an alleged internal database supposedly obtained from an Azure tenant with compromised credentials and included a sample of roughly 7,500 records. Reported fields included names, corporate email addresses, job titles, departments, phone numbers, physical addresses, and account information, but available evidence only confirms that data is being marketed online, not that HCLTech was breached, that the dataset is authentic, or that Microsoft Azure itself was compromised.
Aug 11, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
A threat actor using the alias **"TheHatman"** is advertising and selling data allegedly stolen from the Azure and Entra tenants of at least nine large enterprises, including **McDonald’s, Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies,** and **Wyndham Hotels**. The exposed datasets reportedly contain millions of records and appear to be legitimate internal employee directory exports, including employee identities, contact details, job titles, manager relationships, organizational structure, group memberships, service accounts, and in some cases **Global Administrator** or other privileged account listings. Researchers said the data samples appear credible and follow a consistent Azure directory export-like structure, increasing concern that the information was exfiltrated through compromised credentials rather than any underlying Azure platform flaw. Reporting points to a targeted credential-theft operation, with **infostealer infections**, phishing, weak MFA enforcement, or abuse of third-party API permissions cited as likely access paths; investigators also linked compromised Azure credentials tied to several affected firms. The exposure creates immediate risk of **spear-phishing, business email compromise, social engineering,** and **privilege escalation** against the impacted organizations.
Aug 17, 2026