Tata Consultancy Services (TCS) said it has received threat-intelligence alerts about the possible exposure of some employee information, but said its investigation found no credible evidence that its systems or customer environments were breached.
“The information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS operational systems have been impacted. The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector,” TCS said in an exchange filing.
The filing followed an August 10 post on X by the handle @S2W_DailyThreat, which claimed that TCS employee data was being offered for sale through an Azure dump on the darknet by “TheHatman”.
The post claimed the data included employees’ full names, employee IDs, email addresses, job titles, phone numbers and addresses.
“The listing attaches a 6,000-record sample and Session, Tox, and Jabber contact channels. The seller also advertises additional corporate dumps on request,” the post said.
TCS said it had examined the claims and had “not found any credible evidence of a breach of TCS systems or customer environments.”
The company also said it had maintained safeguards against the techniques allegedly used in the incident for more than two years.
“Based on the current review, these controls remain effective, and the Company continues to monitor the environment closely. The Company will continue to assess any new information that becomes available and take appropriate action, if required,” TCS said.
It added, “The Company remains committed to maintaining the security and resilience of its systems and to protecting the information entrusted to us.”
