Accenture Confirms Data Breach After Hacker Claims Source Code Was Stolen
The consulting giant says the incident is contained and caused no disruption, but a hacker has publicly claimed to have taken internal source code.
Key points
- A hacker publicly claimed to have stolen source code, meaning the internal programming instructions that make software work, from Accenture.
- Accenture, one of the world's largest IT and consulting firms, confirmed a data breach occurred.
- The company says it contained the breach, fixed the entry point, and saw no disruption to its services or operations.
- No details have been released about how many records were exposed, which clients were affected, or which regulator has been notified.
A hacker has claimed to have stolen source code from Accenture, the global consulting and technology company that counts governments and major corporations among its clients. Accenture confirmed a breach took place. The confirmation, first reported by SecurityWeek, came after the hacker made the claim publicly.
Source code is the set of human-readable instructions that programmers write to build software. If Accenture's internal source code was taken, that could expose how the firm's proprietary tools work, potentially making it easier for criminals to find weaknesses in those systems later.
What was actually taken?
That question is still largely unanswered. Accenture has confirmed the incident happened and said it has been contained. The company told reporters that it "remediated its source" and experienced no operational or service delivery impact. What it has not said publicly: which specific data was taken, whether client data was involved, the date range of the exposure, or how the attacker got in.
Without that information, it is impossible to assess the full damage.
No breach-notification letters have surfaced publicly, and no regulatory filing has been confirmed under frameworks such as the EU's GDPR (the General Data Protection Regulation, Europe's main privacy law) or the US FTC (Federal Trade Commission) rules. If personal data belonging to EU residents was exposed, Accenture would typically have 72 hours from discovery to notify its lead supervisory authority.
The hacker's method of entry has not been disclosed. The company has not said whether staff credentials were stolen through phishing (where criminals send fake emails to trick employees into handing over passwords), whether a software flaw was exploited, or whether an insider was involved.
Accenture has faced this before. In 2021 the LockBit ransomware group, which uses malicious software to lock a company's files until a ransom is paid, claimed to have breached the firm and threatened to publish stolen data.
What should Accenture clients do?
If you are an Accenture client, contact your account manager and ask directly whether your data or systems were part of this incident. Watch for any unusual activity on systems that Accenture manages on your behalf. Do not wait for a letter to arrive before asking questions.
