Accenture Confirms Breach After Hacker Offers Alleged Internal Data for Sale

Accenture confirmed a cybersecurity breach after a threat actor using the name "888" advertised roughly 35 GB of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, RSA keys, SSH keys, Azure Personal Access Tokens, and Azure Storage access keys, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting.

Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.