Accenture Confirms Data Breach After Hacker Claims Theft of 35GB of Source Code and Azure Keys

Overview

Accenture has confirmed a security incident after a threat actor known as “888” claimed to have stolen roughly 35GB of source code, cloud credentials, and configuration files from the professional services giant and listed the data for sale on a cybercrime forum, according to BleepingComputer. Accenture has not disclosed how attackers gained access or confirmed the scope of what was taken, according to SecurityWeek.

What We Know

The threat actor posted a listing on the cybercrime forum PwnForums, writing “Today I am selling the Accenture Data Breach, thanks for reading and enjoy!” according to BleepingComputer. The post was made on a Monday, according to Help Net Security.

According to the hacker’s claims, the stolen data totals “just over 35gb of source codes,” according to Help Net Security, and includes RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files, according to BleepingComputer. As proof of possession, the threat actor shared a screenshot depicting a private Azure DevOps repository hosted under an accenture.com domain, according to SecurityWeek; BleepingComputer identified the repository shown in the screenshot as named “121123_AtriasTalentAcademy.”

Accenture confirmed the incident in a statement responding to press inquiries: “We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery,” the company said, according to both BleepingComputer and SecurityWeek. Cybersecurity Dive attributed the same statement to Accenture spokesperson Peter Soh. Accenture did not disclose how the attackers gained access or whether customer data was affected, and did not confirm the scope of data the hacker claims to have taken, according to Help Net Security and BleepingComputer.

The “888” handle is not new to targeting Accenture. The same threat actor previously attempted to sell Accenture employee data following a third-party breach in 2024, according to BleepingComputer and Cybersecurity Dive. Accenture has also disclosed prior security incidents, including a 2021 breach involving the LockBit ransomware gang, according to BleepingComputer and Cybersecurity Dive.

Security researchers flagged the potential downstream risk of the leaked material. Threat intelligence firm SOCRadar told Cybersecurity Dive that “source code can help attackers understand internal application logic, identify weak implementation patterns, and search for hardcoded secrets,” and that “source code and configuration files could help attackers identify vulnerabilities in software used by clients or partners,” according to Cybersecurity Dive. Ross Filipek, CISO at Corsica Technologies, told SecurityWeek that “Accenture is a familiar target because of where it sits in the business ecosystem. Large consulting and services firms often sit close to the systems that help major companies run, from cloud environments and identity tools to codebases and transformation projects,” according to SecurityWeek.

What We Don’t Know

Accenture has not confirmed the full scope, authenticity, or volume of the data the hacker claims to hold. BleepingComputer reported it could not independently verify the full scope of the alleged theft, according to BleepingComputer. Accenture has not disclosed how the attackers gained access, and has not confirmed whether customer data was affected, according to Help Net Security and SecurityWeek.

Analysis

Accenture’s scale amplifies the potential consequences of any confirmed exposure: the company serves the vast majority of Fortune Global 500 companies, according to Cybersecurity Dive. Because consulting and IT-services firms sit close to client cloud environments, identity systems, and codebases, a breach at this level of the supply chain carries risk that extends well beyond the company itself — a dynamic Filipek’s comment to SecurityWeek and SOCRadar’s comment to Cybersecurity Dive both point to directly.