# IT firms face commercial risk from Azure data breaches, experts say 2026-08-27T02:46:28+00:00 | Governance | Indian Opinion Desk Corroboration: 1 independent outlet Several major Indian IT companies including TCS, HCLTech, and Hexaware have downplayed data breaches disclosed this month, but cybersecurity experts say the commercial and reputational damage may outweigh the technical severity. Israeli cybercrime intelligence firm Hudson Rock reported that a hacker accessed the companies' Azure tenants, compromising over 800,000 records from TCS, 250,000 from HCLTech, and 20,000 from Hexaware, including employee names, IDs, emails, phones, and addresses. The companies argue the leaked data is old and limited, a distinction experts say could help them avoid strict notification timelines and penalties under the Digital Personal Data Protection Act. However, analysts warn that even old organisation charts remain useful for social engineering attacks, and that trust is the core product Indian IT sells globally. Cognizant has acknowledged a breach from April 21 and offered affected individuals identity theft protection. Experts say AI-driven attacks require 24x7 threat monitoring instead of periodic checks. ## Indian Opinion Analysis The attacks targeted a decade of accumulated employee directory data across multiple IT firms, not just a single breach event. Under the Digital Personal Data Protection Act 2023, companies must notify the Data Protection Board of any breach within a specific timeline or face penalties of up to Rs 250 crore. The hacker's claim of accessing Azure tenants suggests a supply-chain vulnerability rather than a system flaw, since the data was stored on Microsoft's cloud infrastructure. TCS, which employs over 600,000 people, and HCLTech, with over 200,000 staff, face litigation risk from clients whose contracts include confidentiality clauses. The companies' argument that the data is old may shield them from DPDP liability only if they can prove the breach predates the Act's notification rules taking effect. The next trigger point is any client lawsuit or regulatory inquiry, as the Securities and Exchange Board of India has already required exchange filings on the matter. ## Coverage - rediff.com Leads with expert warning on commercial risk over technical damage, framing data age as legal shield This brief was synthesised by AI from the source linked above. Tags: Cognizant, DPDP Act, HCLTech, Hexaware, Hudson Rock, TCS Canonical: https://indianopinion.org/it-firms-face-commercial-risk-from-azure-data-breaches-experts-say/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/it-firms-face-commercial-risk-from-azure-data-breaches-experts-say/#story-in-brief Review state: restored archive article, accurate at time of publication, not offered to search indexes. How this brief was made: an AI model read the report linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/