Accenture confirms breach after hacker offers 35 GB of stolen data

IT services giant Accenture has confirmed a security breach after a threat actor known as "888" began selling what was reportedly 35 GB of source code and additional material taken from the company.

Accenture acknowledges the incident and states remediation is complete. "We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery," the company told BleepingComputer.

The threat actor lists specific types of data for sale on a cybercrime forum. In the July 2026 post, the actor wrote, "Today I am selling the Accenture Data Breach, thanks for reading and enjoy!" The seller alleged the intrusion produced "just over 35gb of source codes" along with RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files.

The seller also posted a screenshot that appears to depict cloning an Azure DevOps repository called "121123_AtriasTalentAcademy" under a redacted accenture.com address. BleepingComputer could not independently verify the full scope of the data stolen.

Accenture withholds details on breach method and potential customer impact. The firm offered no comment on the claimed volume or categories of information accessed or exfiltrated. It likewise declined to reveal how the attackers gained entry or whether any customer data was involved.

This is the latest in a series of prior Accenture security incidents. The same individual had earlier tried to sell employee information obtained through a 2024 third-party breach. Accenture also experienced an intrusion in 2021 when the LockBit ransomware operation extracted data from its network.

BleepingComputer has asked Accenture further questions about the breach.