TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breach

Executive Summary

In early August 2026 a threat actor using the forum handle "TheHatman" advertised employee-directory data said to have been exfiltrated from the Microsoft Azure and Entra ID tenants of nine large enterprises. The listings were surfaced publicly on 10 August 2026 by the South Korean cyber-intelligence firm S2W, whose @S2W_DailyThreat account reported that roughly 800,000 Tata Consultancy Services (TCS) employee records were among the data offered for sale, with a sample of about 6,000 records attached to the listing.¹ Security outlets and the infostealer-intelligence firm Hudson Rock subsequently documented a wider campaign of about 3.6 million records spanning McDonald's (~1.7 million), TCS (~800,000), Vodafone (~425,000), HCL Technologies (~250,000), InterContinental Hotels Group (~185,000), Kyndryl, Gap Inc., Hexaware Technologies and Wyndham.²³⁴

The data in question is a corporate directory, not source code and not a credential dump. The records reported across the campaign consist of names, employee IDs, corporate email addresses, job titles and departments, phone numbers, postal and office addresses, manager and reporting relationships, group memberships, service-account entries and, in some tenants, the names of Global Administrator accounts.³⁴ Researchers assess that such credentials as were involved were used as a means of access, not themselves published; nothing in the public reporting points to a vulnerability in Microsoft's platform.²³

On the same day the claim surfaced, TCS filed a Regulation 30 intimation (reference TCS/SE/72/2026-27) with the National Stock Exchange of India and BSE. The company said it had "not found any credible evidence of a breach of TCS systems or customer environments," that the referenced information "appears to be more than four years old and limited to basic employee information," and that "there is no indication that customer data, customer systems, or TCS operational systems have been impacted."⁵ TCS further noted that the attacker claimed to have used password spray and multi-factor-authentication (MFA) fatigue, and stated it has "had strong safeguards in place against such techniques for more than two years."⁵

This paper is therefore a claim-versus-denial record. The actor's listing concretely exists and was analysed by named researchers; TCS's denial is a first-party regulatory filing. What remains unverified is the core question: whether any genuine, current TCS data was exfiltrated from TCS systems at all. Hudson Rock judged samples "highly likely authentic" while stating it was "not conclusive how this campaign is being carried out"; BleepingComputer and The Register could not independently confirm the data.²⁶³ As of 6 October 2026 no CERT-In advisory, regulator confirmation, or further TCS filing on the matter has been located. Readers should also not confuse this August 2026 directory-data claim with the separate 2025 incident in which the "Scattered Spider" cluster was reported to have breached Marks & Spencer using credentials associated with a third-party TCS contractor; the two are unrelated.

Verification of Claims

1. Claim: TCS received threat-intelligence alerts and filed a regulatory intimation on 10 August 2026 stating it found no credible evidence of a breach. → Verified → TCS's own Regulation 30 filing (TCS/SE/72/2026-27), digitally signed by Company Secretary Yashaswin Sheth on 10 August 2026, states the company "has not found any credible evidence of a breach of TCS systems or customer environments."⁵

2. Claim: A forum actor "TheHatman" advertised roughly 800,000 TCS employee-directory records within a ~3.6 million-record, nine-company Azure/Entra campaign. → Partially verified → S2W first reported the TCS listing on X; Hudson Rock, The Register, SecurityWeek and BleepingComputer document the wider campaign and sample data.¹²³⁴⁶ The listing's existence is established; the full dataset, its exact size, and its origin in a TCS compromise are not independently confirmed.

3. Claim: The advertised samples are "highly likely authentic" Azure/Entra directory exports. → Partially verified (reported as an assessment) → This is Hudson Rock's stated assessment, based on corporate email structures and field names consistent with Azure directory exports; the same firm said it was "not conclusive how this campaign is being carried out."² Authenticity of a sample is not confirmation of a current TCS breach, which TCS disputes.⁵

4. Claim: The referenced data is "more than four years old" and limited to basic employee information. → Partially verified (first-party assertion) → This is TCS's assertion in its filing; no independent party has dated the data.⁵ Gap Inc. made a comparable statement that its data was "limited in scope, non-sensitive and dated back to several years ago."⁶

5. Claim: The intrusion used password spray and MFA fatigue. → Unverified / conflicting → TCS relays this as the attacker's own claim; Hudson Rock instead attributes access to credentials harvested by infostealer infections.⁵² Neither account has been forensically confirmed for TCS specifically.

6. Claim: No Indian government body has confirmed the leak or issued an advisory. → Verified by absence (as of 6 October 2026) → No CERT-In advisory, vulnerability note, or incident note referencing this campaign or TCS was located, and TCS's exchange-filing history shows no further disclosure on the matter after 10 August 2026.⁷⁸

Timeline

Incident Anatomy

TCS states that no breach of its systems occurred, so the sequence below is the mechanism as claimed by the actor and as reconstructed by Hudson Rock from the advertised data — not a confirmed intrusion of TCS. It is presented at a defender's level of detail.

Initial access (claimed)

Two incompatible accounts exist. The actor, as relayed in TCS's filing, claimed to have used password spraying and MFA-fatigue prompt bombing to obtain a foothold.⁵ Hudson Rock, examining the broader campaign, instead attributed access to valid credentials harvested by infostealer malware running on endpoints — in at least some cases outside the affected organisations' managed estate — and noted the precise entry point remained unconfirmed.²³ Both accounts describe abuse of legitimate identities rather than exploitation of an Azure/Entra platform flaw.²

Directory enumeration and export (claimed)

With an authenticated identity, the actor is said to have enumerated and exported the tenant directory through Microsoft's own interfaces. The resulting records map organisational structure — who reports to whom, which accounts are service accounts, and which hold elevated privilege, including Global Administrator names.³⁴ Every step after the initial credential compromise would have been an authorised action performed by an identity permitted to perform it, which is why such activity is difficult to distinguish from legitimate administration.²

Monetisation

The exported datasets were advertised for sale across cybercrime forums under the "TheHatman" handle, with per-company dumps and proof samples.²³ For TCS, a sample of roughly 6,000 records was attached to a listing claiming about 800,000 records in total.¹ No asking price was disclosed in the public reporting.²⁶

Threat Actor Profile

Name: Unknown. Self-identified by the forum handle "TheHatman."

Aliases: None established; the handle is the only identifier in public reporting.²³

Attribution confidence and basis: No government body, vendor, or affected company has attributed the activity to a named group or individual. "TheHatman" is a self-chosen marketplace persona, not an intelligence-tracked actor.²³

Motivation: Financial. The data was listed for sale; the value of a corporate directory lies in the reconnaissance it provides for follow-on social engineering, spear-phishing and targeted privilege escalation, which Hudson Rock described as the real payoff rather than the dump itself.⁴²

Sophistication: Moderate and opportunistic as described. The campaign relied on abuse of valid credentials and native cloud tooling rather than novel exploitation; Hudson Rock characterised the scale and speed of the dumps as suggesting "a systematic, automated approach once initial access is achieved."²

Prior operations: None reliably linked. The nine-company campaign is the only activity publicly associated with the handle.

The MITRE ATT&CK mapping below describes the claimed mechanism; the techniques are drawn from the two reported access accounts and the directory-export behaviour, and the IDs were verified on attack.mitre.org.

Technical Indicators

actor_handle: "TheHatman (self-identified forum handle)"
marketplace: "underground / darknet cybercrime forum (listing surfaced by S2W on X)"
claimed_source: "Microsoft Azure / Entra ID directory export"
claimed_initial_access:
  - "valid credentials attributed by Hudson Rock to infostealer infections"
  - "password spray and MFA-fatigue (the attacker's own claim, as cited by TCS)"
advertised_record_count_tcs: "~800,000 (actor-advertised; ~6,000-record proof sample)"
campaign_total_records: "~3.6 million across nine named enterprises"
data_categories_claimed:
  - names
  - employee IDs
  - corporate email addresses
  - job titles and departments
  - phone numbers
  - postal and office addresses
  - manager and reporting relationships
  - group memberships
  - service accounts
  - global administrator account names
file_hashes: none disclosed
ip_addresses: none disclosed
domains: none disclosed
malware_family: "not identified in public reporting (infostealer, per Hudson Rock)"
note: >
  No network IOCs, hashes, or malware samples were released publicly; the only
  reported artifacts are the forum handle and the advertised dataset. TCS states
  it found no credible evidence of a breach, and the dataset's authenticity, age
  and origin are unverified. Employee personal data is not reproduced here — only
  the categories and the actor-advertised count are reported.

Legal and Regulatory Response

TCS's response was a Regulation 30 intimation under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, filed with the National Stock Exchange of India and BSE on 10 August 2026 (reference TCS/SE/72/2026-27) and signed by the Company Secretary.⁵ Regulation 30 requires listed Indian companies to disclose material events; TCS used it to acknowledge the alerts and to record its finding of no credible evidence of a breach, rather than to report a confirmed incident.⁵

No enforcement or confirmatory action by an Indian authority has been located. As of 6 October 2026, the Indian Computer Emergency Response Team (CERT-In) had published no advisory, vulnerability note, or incident note referencing this campaign or TCS.⁷ TCS's exchange-filing history shows no further disclosure on the matter after the 10 August 2026 intimation, through 6 October 2026.⁸ Other named companies responded individually to journalists — Gap Inc., for example, said its data was "limited in scope, non-sensitive" with "no evidence to suggest that our corporate systems have been compromised" — but no coordinated regulatory response has been reported.⁶ Microsoft was approached by reporters; no platform vulnerability was identified and no Microsoft statement was published in the reporting reviewed.³

Impact Assessment

• Confirmed: TCS received threat-intelligence alerts and formally disclosed them, stating it found no credible evidence of a breach of its systems or customer environments and no indication of impact to customer data, customer systems, or operational systems.⁵
• Reported, not independently confirmed: A forum actor advertised roughly 800,000 TCS employee-directory records as part of a ~3.6 million-record campaign; Hudson Rock assessed samples "highly likely authentic."²³¹
• Reported (other targets): Gap Inc. and other named firms issued qualified statements; Gap said the data was limited, non-sensitive and years old.⁶
• Estimated: The ~800,000 figure is the actor's own, evidenced publicly only by a ~6,000-record sample; whether the full set exists, is genuine, or is current is not established.¹⁶
• Unknown: Whether any genuine TCS data was exfiltrated from TCS systems at all; the data's true age and provenance; the asking price (none disclosed); and whether any buyer acquired the data.⁵²

Lessons and Defensive Recommendations

For SOC and detection teams. Treat bulk directory enumeration and export in Entra ID as a monitored event: alert on large Microsoft Graph/directory read operations, unusual service-principal or Global Administrator activity, and sign-ins exhibiting impossible travel or atypical client behaviour. The claimed vectors — password spraying and MFA-fatigue prompt bombing — are detectable through failed-authentication baselining and repeated MFA-challenge telemetry.⁵²

For identity and cloud teams. Deploy phishing-resistant, number-matching MFA to defeat fatigue attacks; disable legacy authentication; enforce Conditional Access with risk-based controls; and apply least privilege to service accounts and app registrations so a single compromised identity cannot export the whole directory. Monitor for credentials appearing in infostealer logs, since the broader campaign was attributed to infostealer-harvested credentials used from unmanaged endpoints.²³

For leadership and communications. A corporate directory is reconnaissance-grade data even when it contains no secrets: reporting relationships, service accounts and admin names are a ready map for spear-phishing and privilege escalation.⁴ Distinguish clearly, in any disclosure, between a breach of live systems and the recirculation of old or infostealer-sourced data, and be prepared to substantiate age and provenance claims.

For researchers and journalists. Attacker-advertised counts are self-reported; a small "proof" sample assessed as authentic is not confirmation that a full dataset exists or that it came from a current breach of the named victim.²⁶ Keep this August 2026 directory-data claim distinct from the unrelated 2025 reporting that the Scattered Spider cluster breached Marks & Spencer via third-party TCS contractor credentials.

Sources