McDonald’s employee records allegedly stolen from Azure

As detailed in Security Affairs, a seller on a data-trading forum has posted a sample of what they claim to be 1.7 million McDonald's employee records, allegedly stolen from the company's Azure tenant using compromised credentials.

The seller, operating under the name TheHatman, advertised the data dump, titled "McDonalds 1.7M+ Azure Internal Employee Dump," on a forum. A sample of 8,000 rows was provided for verification. Ransomnews' analysis confirmed the sample's authenticity, noting that its structure and specific data fields, such as FacsimileTelephoneNumber and PhysicalDeliveryOfficeName, are consistent with a standard Microsoft PowerShell export from Entra ID (formerly Azure Active Directory). The sample contains email domains exclusively controlled by McDonald's, spanning corporate, crew, franchisee, and vendor accounts across over thirty countries. Evidence of common export errors, like incorrect character encoding and truncated job titles, further supports the claim of a genuine export rather than a fabricated dataset.

However, the exact age of the data and the veracity of the 1.7 million record claim remain unconfirmed, with the absence of date fields and the sample size being too small to verify the total. The data, if accurate, poses a risk of social engineering attacks due to the inclusion of full names, job titles, and contact information, rather than passwords or hashes.

Source: Security Affairs