A seller claims 1.7M McDonald’s employee records were stolen from Azure. An 8,000-row sample appears genuine, but its age and full size remain unconfirmed. A seller on a data-trading forum posted an 8,000-row sample this week claiming it came from McDonald’s own Azure tenant, part of a supposed 1.7 million-record employee directory obtained using stolen credentials. Ransomnews’s technical breakdown found the sample holds up as genuine on every test that can be run against it. What it can’t confirm, notably, is exactly how old the data is or whether the full 1.7 million figure is real. “The listing is a straightforward private sale, posted at 4:08 AM forum time under the title “McDonalds 1.7M+ Azure Internal Employee Dump”. The seller, an account called TheHatman, writes that the data was “downloaded directly from Azure Tenant using compromised credentials” and that it contains “employee accounts, service accounts, and other tenant account records”. No price is named. Buyers are invited to make offers.” reads the report published by Ransomnews. “To evidence the claim, the seller attached a free 8,000-record sample. That file is the entire basis for what follows. Ransomnews analysed it offline. We did not access, probe or authenticate against any McDonald’s system, and we have redacted the sample’s download location from the screenshot below because it still resolves to real people’s contact details.” The file’s structure gives away exactly what it is before you even read a single row. Column names like FacsimileTelephoneNumber and PhysicalDeliveryOfficeName aren’t something anyone invents; they’re the exact property names Microsoft’s own PowerShell directory tools return when an administrator exports a user list from Entra ID, the modern name for Azure Active Directory. Whoever produced this file ran a standard Microsoft export command and saved the output, nothing more exotic than that. Every one of the 50 email domains found in the sample is genuinely McDonald’s-controlled, spanning corporate staff, restaurant crew accounts, franchisee logins, and vendor guest access across more than thirty countries. Three rows even carry the tenant’s own built-in Microsoft address, mcdonaldscorp.onmicrosoft.com, something that’s invisible from outside the organization and simply isn’t guessable or scrapeable. Add in 233 rows with the exact kind of garbled text encoding that happens when someone forgets to specify UTF-8 during an export, plus 85 job titles cut off at precisely 30 characters mid-word, the unmistakable fingerprint of a fixed-width HR system field bleeding into the directory, and you get a picture consistent with a real export rather than something assembled from public sources. “The file is broken in the ways real exports are broken. 233 rows contain mangled characters: Königswinter appears as “Königswinter”, München as “München”, and Ukrainian job titles are rendered as unreadable strings of Cyrillic run through the wrong character set. This is what happens when somebody runs Export-Csv without specifying UTF-8 encoding.” continues the report. “It’s a mistake, and it is not the kind of mistake anybody makes on purpose. A fabricated dataset doesn’t come with authentic encoding damage.” One detail actually reaches outside the file entirely. A restaurant entry for “556 Upton” on Upton By-Pass in Wirral, complete with phone number, matches a real, publicly listed McDonald’s location down to the digit. That’s a small anchor, but it’s the kind of anchor fabricated data doesn’t usually survive contact with. What the sample genuinely can’t settle is timing. There isn’t a single date field anywhere in the schema, no creation date, no last login, nothing to age a row by. “We can say with confidence that the data came out of McDonald’s directory. We cannot say from the file alone when it came out.” The best clue available is McDonald’s own market footprint: no Russian records at all, consistent with the company’s 2022 exit, and no Kazakh ones either, which points to sometime in 2023 or later, a wide window rather than a firm date. The 1.7 million headline number also isn’t something 8,000 rows can verify. That sample is under half a percent of the claim, and while nothing in it looks implausible given McDonald’s global workforce size, plausible isn’t the same thing as confirmed. A seller running a volume trade across multiple companies has every incentive to round the number up in the listing title. This McDonald’s post wasn’t an isolated event either. The same account, going by TheHatman, posted nine listings in total over sixteen days, claiming roughly 3.6 million records combined across McDonald’s, Vodafone, Gap, two hotel chains, and four major IT outsourcing firms including Kyndryl and Tata Consultancy Services. Every listing uses an identical 19-column schema and nearly identical wording, the kind of consistency you get from one person running the same export script against whatever tenant they currently hold a working login for, not from someone fabricating nine separate datasets by hand. That pattern points toward something fairly mundane and fairly common: infostealer malware harvesting saved credentials at scale, feeding a resale market that lets one operator walk into tenant after tenant using logins nobody bothered to protect with multi-factor authentication. Reading an entire company directory doesn’t require a sophisticated intrusion; it requires one working account in a tenant that hasn’t restricted user enumeration, which is Entra ID’s default setting unless an administrator has explicitly locked it down. For anyone at McDonald’s or one of the other eight listed companies, the real risk here isn’t account takeover, since there are no passwords or hashes in the sample at all. It’s social engineering: full names, job titles, direct phone numbers, and internal email formats are more than enough to make a fake helpdesk call or a fraudulent invoice sound completely legitimate. Treat unsolicited contact that already knows your role and your location with more suspicion than usual, because that’s precisely the kind of detail this file was built to hand someone. “For individuals named in the data, there is no action that removes the exposure.” concludes the report.”The realistic response is scepticism about unsolicited contact that arrives already knowing your role and your store, and a refusal to act on instructions that arrive by phone or email without out-of-band confirmation.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, McDonald’s)
Akira attackers used Safe Mode to disable EDR before deploying ransomware, but memory issues caused the encryptor to fail. An Akira ransomware affiliate broke into a company through an MFA-less SonicWall VPN on August 4, stole credentials and file shares, and then rebooted the compromised host into Safe Mode with Networking to kill the security tools before launching the encryptor. The plan worked on the EDR. It did not work on the ransomware. “After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry.” reads the report published by Huntress. “In this incident, Safe Mode also broke the ransomware. In its stripped-down memory environment, the Akira process tree hit an out-of-virtual-memory failure seconds after launching.” The attacker also added AnyDesk to the Safe Mode registry before rebooting, so their remote access survived the restart even though everything else didn’t. For ten minutes, the host had no working EDR and Defender’s real-time protection was down. The attack followed Akira’s standard playbook almost exactly: VPN credential spray resolved into a successful login at 03:52 UTC, then two hours of quiet before the operator RDP’d to the domain controller, dumped all Active Directory users and computers with a PowerShell enumeration that disabled truncation to capture every group membership, archived mapped file shares with WinRAR using the same flags documented in previous Akira campaigns, and uploaded the data to an attacker-controlled S3 bucket using s5cmd. Exfiltration happened before any encryption attempt, which matters, because it means the victim can still be extorted even when the ransomware fails. The ransomware failed because Safe Mode limited available memory. About 13 seconds after launching, akira.exe triggered multiple memory errors, apparently overwhelming the stripped-down environment and causing the encryption process to fail. “akira.exe executed at 06:34:29 UTC and spawned its child-process burst at 06:36:21 UTC. About 13 seconds later, the host started throwing memory errors:” continues the report. “Safe Mode boots with a stripped-down environment and constrained virtual memory, and the Akira process tree appears to have starved it, getting the “Out of Virtual Memory” pop-up and the cascade of PowerShell hard errors line up exactly with the moment the payload tried to kick things off.” Defender’s scheduled scan eventually detected akira.exe as Ransom:Win32/Akira.B!ibt, but couldn’t quarantine it while real-time protection was disabled in Safe Mode. The file was only removed after the attacker rebooted back to normal mode, restoring Defender’s protections, at which point their own anti-EDR move undid itself. Huntress notes that Snatch and AvosLocker have abused Safe Mode for years, but this is the first time the company observed Akira using it. The more uncomfortable takeaway is that a host with more RAM or a larger page file might have given the encryptor enough memory to run successfully in Safe Mode. Akira’s developers could also reduce the payload’s memory footprint to make Safe Mode launches reliable, which means the same lucky failure won’t necessarily repeat. The detection guidance is specific: alert on msconfig.exe or bcdedit activity, watch for Kernel-Boot Event ID 27 with a SAFEBOOT load option, Kernel-General Event ID 12 with BootMode=2, and third-party services stopping. Also watch for remote-access tools being added to the Safe Mode service registry, that’s the tell that the operator is planning to maintain access through the reboot. “The takeaway is a little uncomfortable. While Safe Mode blinded our controls, it may also have prevented the encryption it was meant to enable. That’s a lucky side effect of the attacker’s own mistake in these circumstances, not a defence you can plan around.” concludes the report. “Ultimately, this could be a case of winning the battle, but not the war. It’s possible that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode. Akria’s developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Akira Ransomware)
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, under certain conditions, could allow an unauthenticated attacker to remotely modify or delete public projects and user data. The flaw, tracked as CVE-2026-19478, has been rated Critical by GitLab and assigned a CVSS score of 9.4. Released on
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "
The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026, when SSD disclosed remote code execution in the
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Confirm this action.
Leaving now will discard your changes.