In brief: An attacker is allegedly offering for sale 3.6 million employee records stolen from the Azure environments of several Fortune 500 companies, obtained via compromised credentials rather than an Azure vulnerability.
A threat actor is offering employee databases for sale on an underground forum, allegedly originating from the Microsoft Azure infrastructure of several Fortune 500 companies. Access is said to have been gained through compromised credentials.
According to a report by BleepingComputer, an actor is marketing records allegedly stolen from the Azure environments of several large corporations. In total, the records are said to comprise around 3.6 million employee data entries. Access to the affected companies’ cloud infrastructure is reported to have been obtained through already-compromised login credentials — not by exploiting a vulnerability in Azure itself.
For CISOs, this case is another example of attacks on the cloud infrastructure of large enterprises increasingly occurring via stolen or reused credentials rather than through technical exploits against the platform itself. Several Fortune 500 companies are reportedly affected, though their names could not be conclusively verified in the report. The risk lies less in a weakness of Microsoft’s infrastructure and more in the security of identities and access rights within organizations’ own Azure tenants.
In practical terms, this means reviewing credential hygiene and identity management in Azure environments: consistent multi-factor authentication for all privileged and administrative accounts, regular rotation and monitoring of service principal and API credentials, as well as monitoring for unusual login activity and data exports from Azure Active Directory or Entra ID. Companies should also check whether their own employee data is circulating on underground forums and immediately reset any affected credentials.
Source: www.bleepingcomputer.com · Published August 17, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.