August 17, 2026
- theHatman selling ~3.6M Azure/Entra records from Fortune 500 tenants. The actor claims to have exfiltrated employee and identity databases after gaining access via compromised credentials; Unit 42 hasn't verified the intrusion vector but recommends credential-attack mitigations, warning of downstream social engineering (BleepingComputer, SecurityWeek). · Aug 17 · claimed · via stolen credentials · Cloud & Identity