"35 GB of Accenture for Sale": Hacker claims source code and credentials theft

A cybercriminal claims to have obtained 35 GB of data from the consulting giant, including source code repositories and RSA and SSH keys.

A threat actor calling himself '888' has posted a message on a dark web forum claiming to have 35 GB of data belonging to Accenture.

The hacker claims to have obtained source code repositories, RSA keys, SSH keys, personal access tokens (Azure Personal Access Tokens or PAT), Azure Storage access keys, and various configuration files.

The attacker claims that these are recent data, dating from this same month of July , and is selling them to the highest bidder. The hacker has not detailed how he managed to obtain these details.

As proof of the alleged intrusion, the cybercriminal has shared a screenshot with the directory tree of the content he claims to possess and offers the dataset to potential buyers.

However, at the moment there is no independent evidence to confirm the authenticity of the information.

Daily Dark Web Intelligence , which has reported this incident, has expressly stated that it has not been able to verify either the content of the alleged loot or that Accenture has suffered a security breach corresponding to the claims of the cybercriminal.

From Digital Shield , we have contacted the company to know more details the alleged unauthorized access and what measures the firm has taken in this regard. The company's communications department assures that they are not aware of a cyberattack at the moment and that they are investigating the matter.

If confirmed, the incident could represent a particularly serious cybersecurity risk. The exposure of the source code would facilitate other attackers' analysis of internal applications to identify exploitable vulnerabilities or develop more sophisticated attacks against the company and its clients.

The risk would be even greater if the cryptographic keys and access credentials included in the alleged theft remained valid. RSA and SSH keys could be used to gain unauthorized access to servers and internal systems, while Azure tokens and storage keys could potentially allow access to resources hosted in Microsoft's cloud.

Additionally, configuration files could reveal details the infrastructure architecture, facilitating lateral movements within the network or compromising the software supply chain.

This incident would not be the first to affect Accenture . Two years ago, in June 2024, the same cybercriminal, 888, claimed to have obtained a database with information on 32,826 employees and former employees of the company and put it up for sale on a well-known dark web forum.

According to his claims at the time, the compromised data included names, email addresses, and transmission dates associated with an internal video call tool called Media Exchange. He also claimed to have potentially more sensitive information, such as Social Security numbers and financial data, although Accenture did not confirm the authenticity of the leak.

Moreover, in 2021 the consultancy already suffered a cyberattack claimed by the ransomware gang LockBit . The group claimed to have stolen more than 6 TB of information and even published part of the stolen data to pressure the company during the ransom negotiation. Accenture then confirmed that the incident affected part of its systems, although it assured that the impact on its operations and those of its clients was limited.

A threat actor calling himself '888' has posted a message on a dark web forum claiming to have 35 GB of data belonging to Accenture.

The hacker claims to have obtained source code repositories, RSA keys, SSH keys, personal access tokens (Azure Personal Access Tokens or PAT), Azure Storage access keys, and various configuration files.

The attacker claims that these are recent data, dating from this same month of July , and is selling them to the highest bidder. The hacker has not detailed how he managed to obtain these details.

As proof of the alleged intrusion, the cybercriminal has shared a screenshot with the directory tree of the content he claims to possess and offers the dataset to potential buyers.

However, at the moment there is no independent evidence to confirm the authenticity of the information.

Daily Dark Web Intelligence , which has reported this incident, has expressly stated that it has not been able to verify either the content of the alleged loot or that Accenture has suffered a security breach corresponding to the claims of the cybercriminal.

From Digital Shield , we have contacted the company to know more details the alleged unauthorized access and what measures the firm has taken in this regard. The company's communications department assures that they are not aware of a cyberattack at the moment and that they are investigating the matter.

If confirmed, the incident could represent a particularly serious cybersecurity risk. The exposure of the source code would facilitate other attackers' analysis of internal applications to identify exploitable vulnerabilities or develop more sophisticated attacks against the company and its clients.

The risk would be even greater if the cryptographic keys and access credentials included in the alleged theft remained valid. RSA and SSH keys could be used to gain unauthorized access to servers and internal systems, while Azure tokens and storage keys could potentially allow access to resources hosted in Microsoft's cloud.

Additionally, configuration files could reveal details the infrastructure architecture, facilitating lateral movements within the network or compromising the software supply chain.

This incident would not be the first to affect Accenture . Two years ago, in June 2024, the same cybercriminal, 888, claimed to have obtained a database with information on 32,826 employees and former employees of the company and put it up for sale on a well-known dark web forum.

According to his claims at the time, the compromised data included names, email addresses, and transmission dates associated with an internal video call tool called Media Exchange. He also claimed to have potentially more sensitive information, such as Social Security numbers and financial data, although Accenture did not confirm the authenticity of the leak.

Moreover, in 2021 the consultancy already suffered a cyberattack claimed by the ransomware gang LockBit . The group claimed to have stolen more than 6 TB of information and even published part of the stolen data to pressure the company during the ransom negotiation. Accenture then confirmed that the incident affected part of its systems, although it assured that the impact on its operations and those of its clients was limited.

Become a premium member for free!