McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen

A seller posted an 8,000-row sample claimed to be part of a 1.7M-record dump of McDonald’s employee directory allegedly taken from its Azure/Entra ID tenant using compromised credentials; forensic indicators in the file (column names, encoding errors, internal domains and addresses) make the export appear authentic, but the sample cannot confirm the dump’s age or full size. The pattern of similar listings suggests infostealer-harvested credentials being reused across tenants; the exposed data contains personal and role information that enables targeted social-engineering attacks even though no passwords or hashes were present.