Compromised credentials used to access corporate Azure tenants

The Register reports that a threat actor is advertising millions of records allegedly stolen from corporate Microsoft Azure tenants belonging to organisations including McDonald's, Vodafone, Tata Consultancy Services and Kyndryl. Security researchers investigating the claims have pointed to compromised credentials as the likely access method, with the attacker appearing to have gained entry to Azure environments through stolen or reused authentication details. The data being advertised includes email addresses, internal documents, configuration details and other corporate information that could be used for further targeting or social engineering. The scope of the compromise suggests the attacker may have systematically targeted Azure tenants where credential security was weak or where multi-factor authentication was not enforced across administrative accounts.

Why this matters for UK organisations

For UK businesses using Azure or any cloud platform, this incident is a reminder that perimeter security increasingly depends on identity and access management. Compromised credentials remain one of the most common initial access methods for attackers, and cloud environments are particularly attractive targets because a single set of credentials can provide access to large volumes of sensitive data, configuration settings and connected services. Organisations that have not enforced multi-factor authentication across all administrative and privileged accounts, or that allow legacy authentication protocols to remain active, are at significantly higher risk. The operational impact of a credential-based compromise can extend well beyond data theft, potentially allowing attackers to modify configurations, create backdoor accounts, or move laterally into connected on-premises systems. The reputational and regulatory consequences of a data breach caused by weak credential security can be severe, particularly where sensitive customer or employee data is involved.

What to review

Organisations should review whether multi-factor authentication is enforced across all Azure administrative accounts, whether legacy authentication protocols such as basic authentication have been disabled, and whether conditional access policies are being used to restrict access based on location, device compliance and risk signals. It is also worth checking whether privileged accounts are being monitored for unusual sign-in activity, whether access reviews are being conducted regularly to remove stale or unnecessary permissions, and whether password policies discourage reuse of credentials across multiple services. For organisations using Azure, Microsoft's Secure Score and Identity Secure Score tools can provide useful visibility into configuration gaps. Finally, it is worth ensuring that security operations teams have clear processes for responding to alerts about compromised credentials, including how to quickly disable accounts, revoke sessions and investigate the scope of access.

Source: The Register