Accenture Data Breach Exposes 35GB Source Code and Azure DevOps Credentials

Accenture is currently investigating a potential data breach after a threat actor using the alias “888” claimed to be selling approximately 35GB of stolen data, including source code and sensitive credentials, on a cybercrime forum.

This listing, posted on July 6, 2026, alleges that the breach resulted in the exfiltration of proprietary assets, including source code repositories, RSA and SSH keys, Azure Personal Access Tokens (PATs), Azure Storage Access Keys, and various configuration files.

Accenture Data Breach

According to the threat actor, the breach occurred in July 2026 and involved unauthorized access to internal development environments.

While the exact method of intrusion remains unclear, the nature of the exposed assets suggests a compromise involving development pipelines or credential leakage related to Azure DevOps infrastructure.

Notably, this is not the first time “888” has claimed to target Accenture; the actor referenced a prior alleged incident in 2024, which the company publicly denied.

To support their claims, the actor shared a screenshot showing command-line activity tied to Azure DevOps services. This output includes a curl request to a “dev.azure.com” endpoint, followed by a git clone operation that appears to access a private repository.

The repository mentioned in the sample, “121123_AtriasTalentAcademy,” is reportedly hosted under an Accenture-associated domain, with metadata indicating project visibility settings and Azure Repos URLs, as reported by CSN.

The screenshot further shows a partial git clone process transferring thousands of objects at high speed, which the threat actor presents as evidence of active, authenticated access to internal repositories. While such artifacts can be fabricated, they are commonly used in underground forums to establish credibility and attract buyers.

The listing has been labeled as a “One-Time Sale,” with payment requested exclusively in Monero (XMR), a cryptocurrency favored by cybercriminals for its privacy-preserving features. At the time of writing, no public price has been disclosed for the dataset.

Accenture has acknowledged the incident but has not confirmed the scope or sensitivity of the allegedly compromised data. In a statement, the company said, “We are aware of this isolated matter, and we have remediated its source.

There is no impact to Accenture operations and service delivery.” This statement suggests that containment has been achieved, though it does not validate the threat actor’s claims.

Security experts caution that the breach details remain unverified and should be treated as preliminary until corroborated by forensic analysis or independent data leaks. However, the mention of Azure DevOps credentials and access tokens raises concerns about potential supply chain risks and unauthorized access to enterprise codebases.

Organizations using Azure DevOps are advised to proactively rotate Personal Access Tokens, audit repository access logs, and review credential exposure risks. Additionally, monitoring for unusual git activity and enforcing least-privilege access controls can help minimize exposure in similar scenarios.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN