A threat actor using the alias “303” has allegedly claimed responsibility for breaching Deloitte’s systems and leaking sensitive internal data on a dark web forum.
According to cybersecurity monitoring services, the purported compromise involves GitHub credentials and source code taken from internal project repositories belonging to Deloitte’s U.S. consulting division. The actor posted details of the alleged breach on a well-known dark web forum, claiming to have accessed and exfiltrated critical development resources.
The leaked material is said to include GitHub credentials that could potentially allow unauthorized access to Deloitte’s internal development infrastructure, along with source code from proprietary projects.
This report adds to Deloitte’s recent cybersecurity challenges. In December 2024 the Brain Cipher ransomware group claimed a breach that Deloitte denied, saying any compromised data came from “a single client’s system which sits outside of the Deloitte network” and emphasizing that “no Deloitte systems have been impacted” in that incident.
Deloitte’s history with credential exposures goes back several years. In 2017 security researchers found that Deloitte’s corporate VPN usernames, passwords and operational details had been exposed in a public GitHub repository.
The actor known as “303” has been linked to other incidents, including an alleged December 2024 breach of an Indian software company that affected major insurance providers. That pattern has led observers to suggest the actor may be part of a broader campaign targeting large corporations and government entities.
The consulting firm has not provided a prompt response to requests for comment or clarification about the recent allegations. Investigations are ongoing, and further details may emerge.
Live Credential Theft Attack Unmask & Instant Defense – Free Webinar
