A newly reported cybercrime campaign is providing another reminder that attackers don’t always need to exploit a sophisticated software vulnerability to create serious risk. Sometimes, they simply need the right information about the right employees.

A threat actor operating under the name “TheHatman” is reportedly offering millions of employee records allegedly obtained from Microsoft Azure and Entra environments belonging to major global organizations. Companies named in the listings include McDonald’s, Tata Consultancy Services (TCS), Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. Researchers say the advertised datasets collectively represent millions of records.

The exposed information is especially concerning because it reportedly goes far beyond a simple list of email addresses. Samples have included employee names, corporate email addresses, phone numbers, job titles, departments, manager relationships, group memberships, service accounts, and other directory information. Some datasets reportedly identify highly privileged accounts, including Global Administrators.

While the exact circumstances surrounding each dataset remain under investigation—and some companies have disputed aspects of the claims—the larger security lesson is clear.

This type of information can become a roadmap for social engineering.

Spear Phishing at Its Best—or Worst

Imagine receiving an email that appears to come from someone in your IT department. The sender knows your name, title, department, manager, and company email address. They may even know which employees have elevated administrative privileges.

The request isn’t generic. It is tailored specifically to you.

That is what makes spear phishing so dangerous.

With accurate organizational information, criminals can impersonate executives, IT administrators, HR personnel, vendors, or coworkers. They can construct believable stories designed to convince employees to disclose credentials, approve an MFA request, open a malicious attachment, transfer information, or provide access to corporate systems.

SecurityWeek notes that information about reporting structures and privileged accounts can enable convincing spear-phishing, business email compromise, and targeted privilege-escalation attacks.

Your Employees Need to Be Ready

Technology remains essential to cybersecurity, but technical controls alone cannot eliminate social engineering risk. Attackers deliberately target people because a convincing message can sometimes bypass layers of expensive security technology.

That makes recurring security awareness training essential.

Employees need to regularly practice recognizing suspicious requests, phishing emails, impersonation attempts, credential-harvesting techniques, MFA fatigue attacks, and other evolving social engineering tactics. Training once during onboarding or once a year simply isn’t enough. Attack techniques change, employees forget, and criminals continuously improve their methods.

Organizations should build a culture in which employees instinctively stop, question, verify, and report suspicious communications.

Make Security Awareness Easier with uRISQ

That’s where uRISQ can help.

uRISQ makes it easy to provide employees with recurring cybersecurity and privacy training on critical topics such as phishing and social engineering. And with our automated training administration engine, organizations can simplify the work behind the program—from assigning training to keeping employees on track—without creating another administrative burden for security and compliance teams.

TheHatman campaign demonstrates why employee information can be valuable to attackers. When cybercriminals have a roadmap to your people, make sure your people are prepared for what may be coming next.

With uRISQ, building that human layer of defense can be simple, consistent, and continuous.