Threat Actor '888' Lists 35GB Accenture Haul on PwnForums: Source Code, Azure PATs, SSH/RSA Keys Offered for XMR

On July 6, prolific PwnForums moderator '888' posted a one-time-sale listing claiming 35GB stolen from Accenture in July 2026, including source code, RSA keys, SSH keys, Azure Personal Access Tokens, Azure Storage access keys, and configuration files. A sample screenshot showed what appears to be an Azure DevOps repository on an accenture.com production URL. Accenture confirmed an isolated breach to multiple outlets but stated no operational impact — stopping short of validating the data types or volume claimed. The exposed Azure PATs and storage keys pose a downstream client risk, as Accenture services Microsoft, Google, AT&T, and Verizon, among others.

A sample screenshot showed what appears to be an Azure DevOps repository on an accenture.com production URL.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.