Accenture Data Breach – Hackers Allegedly Claim to Have Stolen 35 GB of Source Code

A threat actor operating under the alias “888” has posted a listing on a cybercrime forum claiming to sell data allegedly stolen from the IT services and consulting giant Accenture, with the stated haul totaling roughly 35 GB of source code and associated credentials.

The forum post, dated July 6, 2026, states that “In July 2026, Accenture suffered a data breach which resulted in just over 35gb of source codes getting stolen from the company”. According to the actor, the compromised material spans source code, RSA keys, SSH keys, Azure Personal Access Tokens (PATs), Azure Storage Access Keys, and configuration files.

This is not the actor’s first alleged run at Accenture; “888” reportedly targeted the company in a prior, unverified incident in 2024 that Accenture publicly disputed.

To lend credibility to the claim, the actor published a sample screenshot showing command-line output tied to Azure DevOps, including what appears to be a curl request against a “dev.azure.com” endpoint and a subsequent git clone operation.

The captured output references a repository named “121123_AtriasTalentAcademy,” described as hosted under a redacted accenture.com production URL, with associated project metadata, visibility flags, and remote URLs for Azure Repos.

The sample also shows a partial git clone in progress, receiving several thousand objects at tens of megabytes per second, which the actor presents as proof of live access to a private repository.

The listing is framed as a “One Time Sale,” with the actor stating that payment will be accepted exclusively in Monero (XMR), a privacy-focused cryptocurrency favored on cybercrime forums to obscure transaction trails. No price has been publicly disclosed in reporting so far.

Accenture has confirmed a breach, but has not verified the scope or the specific types of data claimed by the threat actor. The company told BleepingComputer, “We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery”.

Security teams are advised to treat the specific data types and volume as unconfirmed until forensic evidence or a data sample leak provides stronger corroboration.

Organizations using Azure DevOps are nonetheless encouraged to review PAT rotation policies and audit repository access logs as a precaution, given the credential types referenced in the alleged sample.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide