Threat Actor Claims to be Selling 35GB of Alleged Accenture Internal Data

A hacker in an underground forum is claiming they have over 35GB of internal data from the top IT consulting firm, Accenture, for sale.

The threat actor says the archive contains highly sensitive technical assets. If genuine, the exposed information could have serious implications for Accenture’s customers worldwide.

Details of the Unverified Claims 

According to the threat actor, who goes by the pseudonym ‘888’, the alleged breach happened this July. The hacker also posted a screenshot showing the file structure of the stolen data as evidence to back their claims.

The hacker claims that the stolen package consists of source codes, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and various configuration files. The hacker also pointed out that these elements are necessary for any software development and cloud computing company.

Nonetheless, there is no independent confirmation that the leaked information is genuine. As the intelligence source “Daily Dark Web’ reported, the information has not been verified and there is no evidence of the hacking attack against Accenture.

Why the Alleged Data Matters

Source code can disclose the workings of a company’s software, but it doesn’t pose serious risks. But if hackers combine it with authentication keys and cloud credentials, there could be bigger problems.

RSA and SSH keys could let attackers access internal servers and systems without authorization. Azure tokens and storage keys might allow entry to resources hosted in Microsoft’s cloud. Configuration files could reveal details about infrastructure architecture.

The value of such access is underscored by Russian hackers’ targeting of secure communications, the US has offered a $10 million reward for information on hackers targeting Signal. This combination could help attackers move laterally within networks or compromise the software supply chain.

Security professionals consider exposed secrets more dangerous than source code alone. Code reveals how an application is built, but valid credentials provide a door to walk right in.

Possible Risks of Supply Chain Attacks

Accenture is one of the top companies in IT consulting. The company provides services in cloud computing, cyber security, software engineering, artificial intelligence, and managed solutions to both big organizations and governments around the world. Thus, any vulnerability discovered in the company’s environment may affect parties outside the company.

If attackers obtained working credentials, they could access internal development systems. They could potentially modify software before its deployment. They could steal additional sensitive information or target customer environments connected to shared infrastructure.

There is no evidence that any of these scenarios has occurred. They remain potential risks based solely on the alleged contents of the advertised archive.

Not Accenture’s First Encounter with Cybercrime

Accenture’s no stranger to cyber threats. LockBit ransomware once targeted the company and claimed responsibility for stealing 6TB of data. The hacker group demanded that Accenture pay $50 million as ransom, otherwise they’d release the data.

Accenture investigated it and admitted there was some suspicious activity in their systems. But they insisted it didn’t affect their operations and customers in a big way. Security analysts noted the leaked files appeared limited to corporate communications without sensitive customer data.

Months ago, the same cybercriminal ‘888’ claimed to have obtained a database with information on over 32,000 Accenture employees and former employees. Accenture disputed the claim, stating it contained only three genuine names and email addresses.

This history shows why organizations investigate new breach claims carefully before confirming them publicly.

For now, there is no evidence that Accenture has suffered a breach as the actor described in the forum advert. The alleged archive is still an unverified dark web listing. We’ll know more once Accenture releases an official statement or technical details. Right now, these claims are just rumors, so no jumping to conclusions.