Accenture Confirms Data Breach After Hacker Claims 35GB Theft Accenture, a leading global IT services provider, has acknowledged an isolated data breach following claims by a hacker known as “888” to be selling 35GB of stolen source code and credentials. The company stated it has remediated the incident with no impact on operations or service delivery. On July 6, the threat actor “888” posted on a cybercrime forum, offering the stolen data for sale. The haul reportedly included source code, RSA and SSH keys, Azure Personal Access Tokens (PAT), Azure storage access keys, and configuration files. A sample of the data was provided as proof. Screenshots shared with cybersecurity organizations showed the attacker cloning an Azure DevOps repository. Accenture did not disclose details about the breach, including the nature of the compromised data (whether internal or customer-related), how it was accessed, or the timeline of the incident. This is not the first time the company has faced such threats earlier in 2024, the same hacker attempted to sell Accenture employee data linked to a third-party breach. While the company maintains that the breach was contained, the incident underscores ongoing risks to enterprise security, particularly involving source code and access credentials. No further operational disruptions have been reported.

Accenture Confirms Data Breach After Threat Actor Claims Theft of 35GB of Source Code Global IT services provider Accenture has acknowledged a security breach following claims by a threat actor known as "888" to have stolen 35GB of sensitive data, including source code, encryption keys, and access credentials. The incident, which the actor alleges occurred in July 2026, was first advertised for sale on a cybercrime forum earlier this month. According to the threat actor, the exfiltrated data includes RSA and SSH keys, Azure Personal Access Tokens (PATs), Azure Storage access keys, and configuration files, alongside source code from an internal repository. A screenshot shared by "888" appears to show the cloning of an Azure DevOps repository named "121123_AtriasTalentAcademy" under an Accenture domain, though the full scope of the breach remains unverified. In a statement to BleepingComputer, Accenture confirmed the incident but described it as an "isolated matter" that has since been remediated. The company asserted that the breach had "no impact on Accenture operations or service delivery" but did not address whether customer data was compromised or how the attackers gained access. This is not the first time Accenture has faced such an incident. In 2024, the same threat actor attempted to sell employee data linked to a third-party breach, while in 2021, the LockBit ransomware gang successfully exfiltrated data from the company’s systems. Accenture has not provided further details on the type or volume of data accessed, nor has it clarified the attack vector. Investigations into the breach are ongoing.

Ransomware Surge in Q2 2026: Business Services Overtakes Manufacturing as Top Target Brandefense’s Ransomware Trends Report Q2 2026 reveals a sharp escalation in ransomware activity, with 2,509 confirmed incidents a notable increase from the previous quarter. The report highlights a strategic shift in attacker focus, as business services surpassed manufacturing as the most targeted sector, reflecting ransomware groups’ evolving tactics to maximize financial gain. Key findings include: - Emerging threat groups like Qilin and Akira gained momentum, expanding into new industries while refining their techniques. - Affiliate ecosystems continue to evolve, enabling faster adaptation and higher attack volumes. - Geographic and sectoral risks vary, with certain countries and industries facing disproportionate exposure. - Attack sophistication is rising, with operators leveraging advanced methods to evade detection and increase pressure on victims. The report also underscores the limitations of relying on historical threat data, as ransomware operators rapidly adjust their strategies. Security teams are urged to adopt proactive intelligence to anticipate shifts in targeting and techniques ahead of Q3 2026. In parallel, recent cybersecurity developments include: - OpenSSH 10.4, which patches multiple vulnerabilities and introduces post-quantum cryptography support. - A 16-year-old Linux KVM flaw enabling guest-to-host escapes on Intel and AMD systems. - Microsoft’s Defender zero-day fix, addressing a high-severity vulnerability actively exploited in the wild. - BeyondTrust’s emergency updates for critical authentication bypass flaws in its remote support and privileged access platforms. - Accenture’s confirmation of a security breach following claims of stolen source code. The report provides actionable insights for CISOs, SOC teams, and threat researchers to prioritize defenses amid an increasingly dynamic ransomware landscape.

Accenture Confirms Data Breach Following Hacker Claims of Source Code Theft Accenture, a global IT services and consulting firm, has confirmed a data breach after hackers claimed to have exfiltrated 35GB of sensitive data. The stolen material reportedly includes source code, encryption keys, authentication tokens, and configuration files assets that could provide attackers with prolonged access to internal systems and third-party connections. Security experts, including Ross Filipek, CISO at Corsica Technologies, highlight the broader risks of targeting large consulting firms like Accenture. Due to their role in managing cloud environments, identity tools, and enterprise transformation projects, breaches in such organizations can expose critical insights into how major companies structure their systems, authenticate users, and maintain trusted connections. Stolen data may serve as a blueprint for future attacks, enabling threat actors to refine phishing campaigns, exploit vulnerabilities, or impersonate trusted entities. While Accenture has not disclosed the full scope of the breach or its potential impact on clients, the incident underscores the cascading risks of supply-chain compromises. The theft of source code and credentials could allow attackers to identify patterns in shared infrastructure, vendor relationships, or customer dependencies, amplifying the long-term consequences beyond the initial breach. The confirmation follows recent trends of high-profile breaches targeting source code repositories, reflecting a growing focus on intellectual property and operational intelligence as prime targets for cybercriminals. No timeline or attribution for the attack has been publicly disclosed.

It consulting firm Accenture was targeted by the LockBit ransomware group. The attackers affected its system and stole data from it and threaten to release it online. However, no operations of the firm or clients were disturbed by the attack as the systems were soon isolated.