McDonald’s Employee Data Leak Exposes 1.7M Records in Alleged Azure Breach
A data seller known as TheHatman has claimed to have stolen 1.7 million McDonald’s employee records from the company’s Azure tenant, offering an 8,000-record sample as proof. Cybersecurity outlet Ransomnews analyzed the sample and confirmed its authenticity, noting that the data appears to be a direct export from Microsoft’s Entra ID (formerly Azure Active Directory) using compromised credentials.
The leaked sample includes employee accounts, service accounts, and tenant records spanning over 30 countries, with domains exclusively tied to McDonald’s corporate, franchise, and vendor systems. Technical details such as mangled character encoding from a non-UTF-8 export and truncated job titles further support the claim that the data originated from a legitimate internal directory dump. A specific entry matching a real McDonald’s location in Wirral, UK, adds another layer of credibility.
However, key details remain unverified. The sample lacks date fields, making it impossible to determine when the breach occurred, though the absence of records from Russia and Kazakhstan suggests a post-2022 timeline. The full 1.7 million-record claim also cannot be confirmed from the sample alone, which represents less than 0.5% of the alleged dataset.
TheHatman has posted similar listings for nine other organizations including Vodafone, Gap, and IT outsourcing firms like Kyndryl and Tata Consultancy Services totaling around 3.6 million records. The consistent schema and wording across listings suggest a single operator using automated scripts to extract data from compromised Azure tenants, likely via infostealer malware that harvested credentials lacking multi-factor authentication (MFA).
While the leaked data does not include passwords or hashes, it contains sensitive details such as full names, job titles, phone numbers, and internal email formats that could facilitate social engineering attacks. The incident underscores the risks of unsecured directory access in cloud environments, where default Entra ID settings allow user enumeration unless explicitly restricted.
McDonald's cybersecurity rating report: https://www.rankiteo.com/company/mcdonald's-corporation
McDonald's Singapore cybersecurity rating report: https://www.rankiteo.com/company/mcdonald-s-singapore
"id": "MCDMCD1786973602",
"linkid": "mcdonald's-corporation, mcdonald-s-singapore",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'industry': 'Fast Food/Restaurant',
'location': 'Global (30+ countries)',
'name': 'McDonald’s',
'size': 'Large enterprise',
'type': 'Corporation'}],
'attack_vector': 'Compromised credentials (infostealer malware)',
'data_breach': {'data_exfiltration': 'Yes (sample data posted for sale)',
'number_of_records_exposed': '1.7 million (alleged)',
'personally_identifiable_information': 'Yes (full names, job '
'titles, phone '
'numbers, email '
'formats)',
'sensitivity_of_data': 'High (full names, job titles, phone '
'numbers, internal email formats)',
'type_of_data_compromised': ['Employee records',
'Service accounts',
'Tenant records']},
'description': 'A data seller known as *TheHatman* has claimed to have stolen '
'1.7 million McDonald’s employee records from the company’s '
'Azure tenant, offering an 8,000-record sample as proof. The '
'leaked data includes employee accounts, service accounts, and '
'tenant records spanning over 30 countries, with domains tied '
'to McDonald’s corporate, franchise, and vendor systems. The '
'sample was confirmed authentic by cybersecurity outlet '
'*Ransomnews*, and technical details suggest it originated '
'from a legitimate internal directory dump via compromised '
'credentials.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'employee data exposure',
'data_compromised': '1.7 million records (alleged)',
'identity_theft_risk': 'High (exposed full names, job titles, '
'phone numbers, and email formats)',
'operational_impact': 'Potential social engineering risks due to '
'exposed employee details',
'systems_affected': 'Microsoft Azure Entra ID (corporate, '
'franchise, and vendor directories)'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes (sample posted for '
'sale)',
'entry_point': 'Compromised credentials (likely via '
'infostealer malware)'},
'investigation_status': 'Unverified (sample confirmed authentic, but full '
'dataset unverified)',
'lessons_learned': 'Unsecured directory access in cloud environments (e.g., '
'Azure Entra ID) poses significant risks, especially when '
'MFA is not enforced. Default settings may allow user '
'enumeration unless explicitly restricted.',
'motivation': 'Data theft for sale (likely financial gain)',
'post_incident_analysis': {'root_causes': ['Lack of multi-factor '
'authentication (MFA) for Azure '
'Entra ID accounts',
'Unrestricted user enumeration in '
'Entra ID',
'Credential theft via infostealer '
'malware']},
'recommendations': ['Enforce multi-factor authentication (MFA) for all Azure '
'Entra ID accounts',
'Restrict default user enumeration settings in Entra ID',
'Monitor for unusual access patterns or credential theft '
'via infostealer malware',
'Conduct regular audits of cloud directory permissions '
'and access logs'],
'references': [{'source': 'Ransomnews'}],
'threat_actor': 'TheHatman',
'title': 'McDonald’s Employee Data Leak Exposes 1.7M Records in Alleged Azure '
'Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Unsecured Azure Entra ID (formerly Azure Active '
'Directory) with lack of multi-factor '
'authentication (MFA)'}