Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials

Millions of enterprise employee records are currently exposed following a campaign that leveraged compromised Azure credentials. Organizations including McDonald's, Vodafone, TCS, HCL, and Hexaware have been identified as victims in the breach. The unauthorized access has resulted in the dissemination of sensitive data, with one seller claiming to hold 1.7 million records specifically linked to McDonald's.

The breach stems from the use of infostealers to obtain legitimate Azure directory credentials. CyberSecurityNews, cyberpress.org, CRN Asia, Security Affairs, and InfoStealers report that these credentials allowed threat actors to gain entry to enterprise systems and exfiltrate significant volumes of data. Security Affairs notes that the data is actively being offered for sale, confirming the scope of the incident reaches across multiple global sectors.

Whether additional organizations are compromised through the same credential theft methods is not yet specified by existing documentation. The full extent of the data exposed beyond the reported 1.7 million records linked to McDonald's remains subject to ongoing verification as security investigations proceed.