McDonald's employee data surfaces on dark web forum, seller claims 1.7 million records stolen

A seller operating under the name TheHatman posted an 8,000-row sample this week on a data-trading forum, claiming it represents a fraction of 1.7 million employee records extracted from McDonald’s Azure tenant using stolen login credentials. An offline technical analysis of the sample determined the data holds up as authentic on every test that could be applied to it, though the age of the records and the accuracy of the 1.7 million figure could not be confirmed.

The listing appeared at 4:08 a.m. forum time under the title "McDonalds 1.7M+ Azure Internal Employee Dump." The seller wrote that the material was downloaded directly from the company’s Azure tenant using compromised credentials and includes employee accounts, service accounts and other tenant records. No asking price was listed; the post instead solicited offers. Analysts examined the free sample offline and did not attempt to access, probe or authenticate against any McDonald’s system. The download location included in the seller’s post was withheld from published materials because it still links to real individuals’ contact information.

Several technical markers pointed toward a genuine administrative export. Column headers such as FacsimileTelephoneNumber and PhysicalDeliveryOfficeName match the exact property names generated by Microsoft’s PowerShell directory tools when an administrator exports a user list from Entra ID, the current name for Azure Active Directory. All 50 email domains identified in the sample belong to McDonald’s, covering corporate staff, restaurant crew accounts, franchisee logins and vendor guest access across more than 30 countries. Three entries carried the tenant’s internal Microsoft address, mcdonaldscorp.onmicrosoft.com, which is not visible or accessible from outside the organization.

The sample also contained 233 rows with garbled character encoding consistent with an export that omitted UTF-8 formatting, along with 85 job titles truncated at exactly 30 characters, a pattern associated with fixed-width fields in human resources software. Ransomnews said the encoding errors were not something that would appear in fabricated data. "It’s a mistake, and it is not the kind of mistake anybody makes on purpose," Ransomnews said. "A fabricated dataset doesn’t come with authentic encoding damage." One entry extended beyond the file itself: a restaurant listing for "556 Upton" on Upton By-Pass in Wirral, including a phone number, matched a real, publicly listed McDonald’s location.

The sample contained no date fields, making it impossible to determine when the data was extracted. The clearest available indicator involved the company’s operational footprint: the sample contained no Russian records, consistent with McDonald’s 2022 exit from that market, and no Kazakh records, suggesting the data dates to 2023 or later. The claimed total of 1.7 million records could not be verified against the sample, which represents less than half a percent of that figure.

The McDonald’s posting was one of nine listings from the same TheHatman account over a 16-day period, claiming a combined total of roughly 3.6 million records across McDonald’s, Vodafone, Gap, two hotel chains and four information technology outsourcing firms, including Kyndryl and Tata Consultancy Services. Each listing used an identical 19-column schema, a pattern Ransomnews attributed to a single operator running the same export script against tenants where they held working credentials, consistent with infostealer malware harvesting saved logins that were not protected by multi-factor authentication.

The sample contains no passwords or password hashes, meaning the immediate risk centers on social engineering rather than account takeover. "For individuals named in the data, there is no action that removes the exposure," Ransomnews said, adding that the realistic response is skepticism toward unsolicited contact and a refusal to act on instructions without independent confirmation.