Loading story…
Accenture confirmed a cybersecurity breach after a threat actor using the name "888" advertised roughly 35 GB of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, RSA keys, SSH keys, Azure Personal Access Tokens, and Azure Storage access keys, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting.
Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Accenture acknowledged a cybersecurity incident and said it detected irregular activity, investigated the matter, contained the affected environment, and restored impacted systems. The company also said it remediated the source of the incident and that operations and service delivery were not impacted, while not confirming the full scope of any stolen data.
A threat actor using the name "888" claimed to have stolen and listed about 35 GB of Accenture data for sale on a cybercrime forum. The actor alleged the data included source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files, and shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcehipaajournal.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcesecuritymagazine.com
Open sourcecysecurity.news
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adaptavist Group, a UK enterprise software consultancy, disclosed a security breach after an unauthorized actor used stolen credentials in late March to access some of its systems. The company said it launched an internal review and brought in external forensic specialists to investigate, adding that the affected environment held routine business information including contact details, contracts, and NDAs. Adaptavist said it has found no evidence that customer or partner personal data, client systems, or production systems were compromised, and disputed claims that sensitive customer data was accessed or exfiltrated. A ransomware group calling itself **The Gentlemen** claimed responsibility on its leak site and alleged a far broader intrusion, including theft of customer records, source code, internal documents, credentials, and access to production systems, but those assertions remain unverified. Adaptavist also warned that unknown actors are sending misleading emails impersonating the company, suggesting follow-on phishing activity linked to the incident while the forensic investigation continues.
Jun 29, 2026
A threat actor using the alias **"Mr. Raccoon"** has allegedly breached Adobe support systems through a third-party Indian BPO contractor and claims to have stolen a large cache of sensitive data. According to unverified reports and social media posts, the actor first compromised a contractor employee with a malicious email delivering a remote access trojan, then expanded access by phishing the employee’s manager. The attacker says the intrusion exposed more than **13 million support ticket records**, roughly **15,000 employee records**, internal documents, Adobe’s Microsoft SharePoint environment, and submissions from Adobe’s **HackerOne** bug bounty program. The reports further allege the actor abused overly permissive ticket export functionality that allowed bulk extraction of support data in a single request, raising concerns about phishing, identity theft, and exposure of unpublished vulnerability disclosures. The incident, if confirmed, would represent a significant third-party supply chain compromise affecting Adobe’s support operations. Adobe had not publicly confirmed or denied the claims at the time the reports were published.
Jun 29, 2026
Vercel confirmed a security incident involving unauthorized access to certain internal systems after a threat actor using the name **ShinyHunters** claimed to be selling allegedly stolen company data on a hacking forum. The company said only a limited subset of customers was affected, its services remain operational, and it has engaged incident response experts, notified law enforcement, and is working directly with impacted customers. The actor claimed the stolen data included access keys, source code, database data, internal deployment access, and API keys, and shared a text file with 580 employee-related records along with a screenshot purportedly showing an internal Vercel Enterprise dashboard. Vercel advised customers to review environment variables and rotate secrets if necessary, while the authenticity of the leaked materials and the attribution to **ShinyHunters** remained unverified; the actor also claimed on Telegram that a **$2 million** ransom demand had been discussed with the company.
Jun 29, 2026