Threat Actor '888' Lists 35GB Accenture Azure DevOps Haul on PwnForums — Source Code, RSA Keys, PATs, and SSH Keys Offered for Sale in Monero

A threat actor operating as '888' posted a forum listing on July 6, 2026, claiming to sell 35GB of data stolen from Accenture, including source code, Azure Personal Access Tokens, RSA and SSH keys, and cloud configuration files, with a screenshot showing a live git clone from a private Azure DevOps repository on an accenture.com production domain as proof of access. Accenture confirmed the breach on July 8, characterizing it as an 'isolated matter' that has been remediated, while declining to confirm exfiltration scope or the attack vector. The primary risk to defenders is downstream: Accenture manages cloud infrastructure and transformation projects for the majority of the Fortune Global 500, meaning leaked Azure keys and config files could serve as a roadmap for supply-chain lateral movement into client environments.

Accenture confirmed the breach on July 8, characterizing it as an 'isolated matter' that has been remediated, while declining to confirm exfiltration scope or the attack vector.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.