HCLTech, TCS Data Claims Put India’s IT Giants on Cyber Alert

India’s IT services industry is facing renewed cybersecurity scrutiny after HCLTech and Tata Consultancy Services (TCS) received alerts concerning the possible exposure of employee information. Both technology majors, however, say their investigations have found no evidence of breaches affecting corporate systems or customer environments.

HCLTech said a hacker group had claimed access to employee-related information. Following an initial investigation, the company stated that there was no evidence of a breach of its systems or any impact on client engagements. The allegedly exposed information appears to be limited and several years old, although further investigation is continuing.

The development came shortly after TCS informed stock exchanges that it had received threat-intelligence alerts concerning possible exposure of certain employee information. TCS similarly said its investigation had uncovered no credible evidence that its systems or customer environments had been compromised.

The incidents nevertheless highlight an important cybersecurity challenge. Data appearing in criminal forums does not automatically establish that an organization’s current infrastructure has been breached. Information can originate from historic incidents, third-party platforms, compromised employee accounts, credential-stealing malware or previously circulating datasets.

For IT services companies, employee information remains particularly valuable to attackers. Even outdated data can potentially support phishing, impersonation, credential attacks and sophisticated social engineering. With generative AI making targeted communications increasingly convincing, organizations must consider the continuing risk associated with previously exposed information.

The larger lesson is that cybersecurity increasingly extends beyond the enterprise perimeter. Continuous threat intelligence, identity protection, third-party risk monitoring and rapid incident verification are becoming essential. For India’s technology giants, protecting client infrastructure remains critical-but understanding where employee data travels across the broader digital ecosystem is equally important.