Accenture Confirms Breach as '888' Sells 35GB of Data

Accenture has confirmed it was breached after a threat actor operating under the handle '888' began offering 35GB of the consultancy's data on a cybercrime forum. The company told BleepingComputer the incident was isolated, the source had been remediated, and there was no impact on operations or client service. Beyond that, very little detail.

What's allegedly in the haul

The seller claims the 35GB includes source code, RSA and SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files. To back it up, they posted a screenshot of what appears to be a clone of an Azure DevOps repository sitting under a redacted accenture.com hostname.

BleepingComputer could not verify the full extent of the data, and Accenture has not commented publicly on the specifics of what was taken or how the attacker got in.

Why the contents matter more than the volume

35GB is a modest number in leak-forum terms. It's the mix that raises eyebrows. Source code paired with live credentials is a well-worn recipe for follow-on intrusions, not just into the breached organisation but into the environments it builds and operates for its customers.

Keys and tokens accidentally committed into repositories have a long and unflattering history of being the quiet ignition point for much larger incidents. If any of the credentials being advertised are still valid, the cleanup involves more than reassuring statements.

• Source code reveals architecture, logic flaws, and internal assumptions attackers usually have to guess at.
• RSA and SSH keys are effectively passwords to servers and services, often long-lived and rarely rotated.
• Azure PATs and storage keys can grant direct access to cloud resources, pipelines, and data.

Not '888's first visit

This isn't a fresh grudge either. The same actor tried to sell employee data pulled from a third-party Accenture breach in 2024, and LockBit hit the firm back in 2021. Three appearances on the leak forums in four years is a pattern, particularly for a company whose core business is advising other organisations on how to run secure, modern technology estates.

Accenture's statement, that the source was contained and there was no operational impact, is the standard shape of these disclosures. It doesn't answer the questions people actually want answered: which systems, whose credentials, and whether anything in that repo can still be used against clients today.

The duller, more useful takeaway

The practical lesson underneath the drama is unglamorous. Secrets, keys, tokens, connection strings, belong in a vault, not committed alongside the code that uses them. Access tokens should have short lifetimes and clear owners. Repository scanning for exposed credentials is cheap, and revoking a leaked key before anyone notices is dramatically easier than doing it after 35GB of your codebase is being auctioned to strangers.

None of that is new advice. That's rather the point.