TheHatman stole 800,000 employee records from TCS's Azure tenant
Assessment
The 800,000 figure is the forum actor's own advertised scale, surfaced by S2W on X and evidenced publicly only by a sample of roughly 6,000 records. No independent party has confirmed the full dataset exists, is genuine, or was exfiltrated from TCS systems; TCS's 10 August 2026 exchange filing states it found no credible evidence of a breach and that the data appears more than four years old. Hudson Rock judged samples 'highly likely authentic' but said it was 'not conclusive how this campaign is being carried out'. Repeating 800,000 as a confirmed current breach count overstates what is evidenced.
Where this claim appeared
Outlook Business · 2026-08-10
https://www.outlookbusiness.com/corporate/tcs-faces-employee-data-exposure-claim-says-no-evidence-of-systems-breachWhat “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
TCS employee-directory leak claim: 800,000 records advertised by 'TheHatman', company finds no breachThink this assessment is wrong? Report an error.