Bottom line: Security leaders must prioritize credential protection and implement robust authentication mechanisms to prevent similar attacks.
What's happening: TheHatman, a known actor, claimed to have stolen credentials from at least 10,000 Microsoft Entra tenants, including those of major financial institutions and government agencies, between August 1-15, 2026. This attack is believed to be one of the largest credential thefts on record. The stolen credentials included user IDs, passwords, and other sensitive information.
What to do: Security leaders should immediately assess their Microsoft Entra tenant configurations and implement multi-factor authentication (MFA) for all users, as well as regularly review and rotate credentials to prevent similar attacks.