Accenture Confirms Data Breach After Hacker Offers Stolen Source Code for Sale
Global IT services giant Accenture has confirmed a data breach after a threat actor claimed to have exfiltrated 35 GB of source code and other sensitive data, which is now being offered for sale.
IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company. The breach was disclosed after a threat actor known as "888" began offering the stolen information for sale on a cybercrime forum.
"We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery," Accenture told BleepingComputer in a statement. The company, a global professional services firm providing consulting, technology, cloud, engineering, and managed services, did not elaborate on the nature or extent of the breach.
The threat actor's forum post stated, "Today I am selling the Accenture Data Breach, thanks for reading and enjoy! In July 2026, Accenture suffered a data breach which resulted in just over 35gb of source codes getting stolen from the company." The actor claims the exfiltrated data includes source code, RSA keys, SSH keys, Azure PAT (personal access tokens), Azure Storage access keys, and configuration files.
To substantiate their claims, the threat actor shared a screenshot appearing to show them cloning an Azure DevOps repository hosted under a redacted accenture.com hostname. BleepingComputer has not independently verified the full scope of the data allegedly stolen. Accenture has not commented on the specific claims made by the threat actor regarding the amount or type of data accessed.
It remains unclear how the attackers gained initial access to Accenture's systems or whether any customer data was compromised in this incident. The company has not disclosed these details. This incident follows a pattern of previous security incidents involving Accenture.
The same threat actor, "888," had previously attempted to sell Accenture employee data following a third-party breach in 2024. Additionally, Accenture experienced a significant data breach in 2021 when the LockBit ransomware gang compromised its systems and stole data.
Accenture has stated that the source of the breach has been remediated and that there is no impact on its operations or service delivery. However, the full scope and impact of the breach are still under investigation by the company.
BleepingComputer has reached out to Accenture for further details and will update this story as more information becomes available. The incident highlights the ongoing risks faced by large IT service providers, which often hold vast amounts of sensitive data for their clients.
The threat actor, identified as "888," has posted a listing on a cybercrime forum claiming to sell approximately 35 GB of stolen data, including source code, RSA keys, SSH keys, and Azure Personal Access Tokens. The actor provided a screenshot as proof, showing command-line output related to Azure DevOps and a git clone operation against a private repository. While Accenture has confirmed a breach and stated it has been remediated with no impact to operations, the company has not verified the specific scope or data types claimed by the threat actor.
The threat actor, identified as "888", claims to have exfiltrated source code, RSA and SSH keys, Azure tokens, and configuration files, posting a screenshot of an Azure DevOps repository as proof. Accenture has stated that they have "remediated its source" and that operations were not affected, but has not confirmed the extent of data exfiltration.
The new article confirms the breach and states that the incident has been contained and remediated, with no impact on Accenture's operations or service delivery. It also notes that the specific vector and extent of the breach were not detailed by the company.
The threat actor, identified as "888," previously attempted to sell a dataset purportedly belonging to Accenture employees in June 2024, a claim Accenture disputed at the time. This latest incident involves claims of stolen source code, RSA keys, SSH keys, Azure PATs, and internal configuration files, with proof posted on the cybercrime forum PwnForums. Accenture has confirmed the breach and remediated the source, stating there is no impact on operations, but has not confirmed the full scope of exfiltrated data.
Researchers from SOCRadar and International Cyber Digest have provided further analysis, warning that the exposed Azure tokens, encryption keys, and DevOps secrets could enable follow-on intrusions and supply-chain attacks. The alleged data includes source code for Node.js and React web applications, environment files, SQL scripts, and SSL certificates, raising concerns about the potential for attackers to understand internal application logic and gain unauthorized access to cloud services.
The Accenture data breach, initially reported as a theft of 35GB of source code, is now confirmed by the company. While the full scope and nature of the compromised data are still under investigation, the incident highlights the ongoing risks associated with large-scale data exfiltration targeting major IT consulting firms.