TCS Faces Employee Data Exposure Claim; Says No Evidence Of Systems Breach

Tata Consultancy Services (TCS) has received threat-intelligence alerts alleging the possible exposure of certain employee information, but the IT services major said it has found “no credible evidence of a breach” of its systems or customer environments.

In an exchange filing on Monday, TCS said the information referenced in the alert appears to be more than four years old and is limited to basic employee information. The company added that there is “no indication that customer data, customer systems, or TCS operational systems have been impacted.”

The disclosure came after a post on X by the handle @S2W_DailyThreat alleged that TCS employee data was being sold through an Azure dump on the darknet by an entity identified as “TheHatman”.

What Does The Data Claim Involve?

According to the X post, the allegedly exposed information includes employee names, IDs, email addresses, job titles, phone numbers and addresses. The post also claimed that a sample containing around 6,000 records had been attached to the listing.

TCS, however, has not confirmed that the data described in the post was obtained through a breach of its systems. The company said it investigated the alert and “has not found any credible evidence of a breach of TCS systems or customer environments.”

The company also said the attacker claimed to have used password spraying and Multi-Factor Authentication (MFA) fatigue as the attack method. Password spraying involves trying commonly used passwords across multiple accounts, while MFA fatigue typically involves repeatedly sending authentication requests in the hope that a user eventually approves one.

TCS Says Safeguards Remain Effective

TCS said it has had strong safeguards against such techniques for more than two years. Based on its current review, the company said those controls “remain effective” and that it is continuing to monitor its environment.

The IT major said it will assess any new information that emerges and take further action if required. This means the investigation and monitoring process remains ongoing even though the company has not found credible evidence of a systems breach.

TCS also reiterated its focus on maintaining the security and resilience of its systems and protecting information entrusted to it. The company’s statement therefore draws a clear distinction between the alleged exposure of old employee information and any confirmed compromise of TCS or customer systems.