This month a hacker claimed to have stolen roughly 3.6 million employee records connected to Microsoft Azure accounts at some of the largest companies on earth — McDonald's, Vodafone, Tata, InterContinental Hotels and others. It is a scary headline, and it hides a detail that matters far more than the number: the attacker never broke into Microsoft. They used stolen logins.
According to the researchers who reviewed the data, the records were pulled from Azure and Microsoft Entra tenants using valid usernames and passwords, obtained through "password spray" and "MFA fatigue" — two attacks that work just as well against a twelve-person office in Austin as they do against a global brand. The cloud was never the weak point. The accounts were. That is the whole lesson, and it is one every small business can act on this week.
What Actually Happened
A threat actor going by "TheHatman" posted databases they claim were taken from the Microsoft cloud tenants of major companies. The stolen records reportedly include names, employee IDs, email addresses, job titles, phone numbers, postal addresses and service-account details — the kind of directory information that powers convincing phishing and impersonation later on. A couple of the named companies pushed back, calling the data old and non-sensitive, and the exact method has not been fully confirmed. But the intelligence firms that examined it agree the data looks real.
What no one is disputing is the entry point. This was not a flaw in Azure. It was ordinary accounts being logged into by someone who was not supposed to have them — the single most common way breaches actually happen, and the one most owners assume "the cloud" already handles for them.
The Cloud Was Fine. The Logins Were Not.
It is worth saying plainly, because it changes what you should worry about: Microsoft's platform did its job. Azure did not get hacked. Attackers signed in with credentials that belonged to real employees, and to the system, a correct password from a valid account looks exactly like the real person arriving for work.
This is the reality of every modern cloud tool your business runs on — Microsoft 365, your accounting software, your email, your file storage. The provider secures the building. You are responsible for who holds the keys. When people say "we moved to the cloud so security is handled," this breach is the correction: the cloud moved the lock, it did not decide who gets a key.
Password Spray and MFA Fatigue, in Plain English
The two attacks named in this breach are simple enough that any owner can understand exactly what to defend against.
- Password spray. Instead of guessing one account a thousand times (which locks it), the attacker tries one very common password — think "Summer2026!" — across hundreds or thousands of employee accounts at once. In any company of a certain size, someone is using it. They are not breaking a strong password; they are counting on one weak one out of many.
- MFA fatigue (also called MFA bombing). MFA is multi-factor authentication — the second step, usually a prompt on your phone, that is supposed to stop a stolen password from being enough. In an MFA-fatigue attack, the criminal already has the password and simply triggers that "Approve sign-in?" prompt over and over, at 2 a.m., during a busy afternoon, dozens of times, until a tired or annoyed employee taps Approve just to make it stop. That one tap hands over the account.
Neither of these is sophisticated. Both are stopped by a handful of specific settings — and both walk right past a business that turned MFA on years ago and assumed the job was finished.
Why This Matters for a Business Your Size
It is tempting to read "McDonald's and Vodafone" and decide this is a big-company problem. It is exactly backwards. Global brands have security teams watching sign-ins around the clock. A 20-person firm in Austin usually does not, which makes the same weak password or the same 2 a.m. approval far more likely to succeed and far less likely to be noticed.
And the prize is not always money directly. Directory data — your staff's names, titles, emails and phone numbers — is the raw material for the next attack: a convincing email to your bookkeeper that appears to come from you, a call to a new hire that knows their manager's name. One compromised login inside a small business often opens the door to everyone the business trusts.
What Actually Stops This
The good news is that the defenses here are well understood, and none of them require a big-company budget. They require someone to configure them correctly and keep watching.
- Phishing-resistant MFA and number matching. Replace the simple "tap to approve" prompt with number matching (the app makes you type a code shown on screen) or a physical security key. You cannot fatigue-tap your way past a code you have to read and enter on purpose.
- Conditional access rules. Block or challenge sign-ins that do not fit — a login from another country, an unmanaged device, an impossible-travel jump. Most small businesses never sign in from outside Texas; the system can enforce that.
- Kill weak and reused passwords. Ban the common ones, require length over complexity, and give the team a password manager so "one weak password across the company" stops being possible.
- Watch the sign-ins. Password spray and repeated MFA prompts leave an obvious trail — but only if someone, or something, is actually watching the alerts. This is the piece a small business almost never has, and the piece that turns a caught attempt into a prevented breach.
Every one of these lives inside the Microsoft 365 and Entra tools most Austin businesses already pay for. They are usually just switched off, or left at the weak default. Turning them on correctly is the difference between this headline being someone else's problem and being yours.
Key Takeaways
- The Azure "breach" was not a cloud hack — it was stolen and reused employee logins. The provider secures the platform; you are responsible for the accounts.
- Password spray and MFA fatigue beat any business that turned MFA on once and never hardened it. Number matching and conditional access shut both down.
- A small Austin business is a softer target than a global brand, not a safer one — because no one is usually watching the sign-ins. That monitoring is the fix.
Not sure whether your Microsoft 365 accounts could be logged into the same way? Jorge and the team harden identity, MFA and sign-in monitoring for Austin businesses, so a stolen password is not a stolen company. Explore our Cybersecurity & MDR services or book a free consultation.
