Hacker claims 3.6M Azure account records sold from Fortune 500 firms

Tue, 18 Aug 2026 11:37:25 +0000

Engineer — Plan: The alleged vector is compromised credentials, not a platform vulnerability — audit Azure Entra ID sign-in logs for anomalous authentication, verify MFA is enforced on all accounts, and review conditional access policies for gaps.
SOC/IR — Plan: No IOCs or confirmed TTPs are available yet, but if your estate includes Azure, queue a hunt for unusual authentication patterns in Entra ID logs (off-hours logins, new service principals, bulk data exports) and monitor breach-data feeds for your org’s domains.
Leader — Act: If Azure is in your estate, contact your Microsoft account team this week to ask whether your tenant appears in this claimed dataset, and prepare a brief for leadership in case the story gains traction or your company is named.

Azure on CuraSec