Accenture Confirms Breach; Hacker Claims 35 GB of Data Stolen
Summary
Accenture confirmed an isolated, remediated breach after actor 888 claimed to have stolen 35 GB of data, including source code and access keys. The claimed scope and data types are unverified; customer impact is unknown.
Key points
- Accenture confirmed a security breach and said it had isolated and remediated the issue, with no impact to operations or service delivery.
- Threat actor 888 claimed to have stolen and offered for sale 35 GB of data, allegedly including source code, RSA and SSH keys, Azure access tokens, storage keys, and configuration files.
- The actor shared a screenshot that appeared to show cloning an Azure DevOps repository; BleepingComputer could not independently verify the full scope of the alleged theft.
- Accenture did not disclose how the attackers gained access or whether customer data was affected.
Article Details
- Victim Organization
- Accenture
- Victim Domain
- accenture.com
- Incident Type
- Security breach; a threat actor alleged that source code and related files were stolen, but the scope and exfiltration claims were not independently verified.
- Data Types Exposed
- Source code (alleged)
- RSA keys (alleged)
- SSH keys (alleged)
- Azure personal access tokens (PATs) (alleged)
- Azure Storage access keys (alleged)
- Configuration files (alleged)
- Affected Records
- Unknown
- Affected Data Size
- Threat actor 888 claimed just over 35 GB was stolen; Accenture did not confirm the amount.
- Operational Impact
- Accenture said it isolated and remediated the issue and reported no impact to its operations or service delivery. Whether customer data was affected was not disclosed.
- Ransom Or Extortion
- Threat actor 888 claimed to offer the allegedly stolen data for sale. Accenture did not confirm the theft or sale claim.
- Claim Status
- confirmed
Threat Actors
888Claimed to have stolen just over 35 GB of Accenture data and offered it for sale. Accenture confirmed a breach but did not confirm the alleged data theft or its scope; BleepingComputer could not independently verify the claim.LockBitThe article says LockBit stole data from Accenture systems in a separate 2021 breach; it does not link LockBit to the current incident.
Products
Azure DevOpsTo support their claims, the threat actor shared a screenshot that appears to show them cloning an Azure DevOps repository named “121123_AtriasTalentAcademy” that was hosted under a redacted accenture.com hostname.Azure StorageThe incident reportedly involved sensitive assets such as RSA keys, SSH keys, Azure PATs, Azure Storage access keys, and configuration files, while Accenture said the issue was isolated and remediated.
Industries
IT servicesIT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company.Professional ServicesAccenture is a global professional services company that provides consulting, technology, cloud, engineering, and managed services to businesses and governments worldwide.