Deloitte: how has the cyber adviser’s own house fared?

The Guardian reported that an attacker reached Deloitte’s Microsoft Azure–hosted global email system through an administrator account protected by a single password, with no two-step verification. Deloitte discovered the intrusion in March 2017; the attacker may have had access since October or November 2016.

The Guardian said the attacker potentially had access to around 5 million emails, plus usernames, passwords, IP addresses and business/health information. Deloitte confirmed the incident but said the actual data affected was only “a fraction” of that figure, and that it had notified six clients. The scale remains disputed; the unprotected privileged account is not.

In the mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), the Cl0p ransomware gang listed Deloitte among its victims and claimed to have stolen files. Deloitte stated it had applied the vendor’s security updates and mitigations and denied that it had suffered a breach off the back of the incident.

No Deloitte-specific record count has been substantiated. The wider MOVEit campaign affected well over 1,000 organisations and tens of millions of individuals, which is why a leak-site listing of a firm this large drew attention — but the Deloitte entry remains a gang claim the firm disputes.

The actor IntelBroker posted on BreachForums claiming to have obtained Deloitte internal communications from an internet-exposed Apache Solr instance reachable with default credentials, reportedly including email addresses and internal settings. Deloitte said its investigation “found no threat to client data or other sensitive data related to this incident.”

Deloitte’s wording acknowledges an incident while limiting its scope to non-sensitive data; it did not detail what was exposed. BreachForums claims are frequently exaggerated, so the volume and sensitivity here are unconfirmed — but a Solr server exposed with default credentials is a configuration failure, not a sophisticated attack.

Deloitte, which builds and maintains Rhode Island’s RIBridges health-and-benefits system, notified the state of a potential cyberattack on 5 December 2024; malicious code was confirmed on 13 December and the system was taken offline. Deloitte confirmed to Infosecurity Magazine that the Brain Cipher ransomware group’s claim related to a client of the firm, and Brain Cipher leaked at least some exfiltrated data.

An estimated 644,401 people who received or applied for benefits were affected. Exposed data may include names, addresses, dates of birth, Social Security numbers and some banking information, across Medicaid and other assistance programs. Deloitte paid $5M to the state in February 2025 and agreed a further $7M settlement in April 2026 (about $12M total) — the strongest evidence of impact short of a court finding.

A listing attributed to the “thegentlemen” ransomware-as-a-service operation claimed an attack on Deloitte, per a Dutch IT Channel report dated 12 October 2026; the claim was first surfaced by threat-intelligence platform HookPhish on 9 October 2026. Early reporting says the listing points at the firm’s US branch and central domain.

As of this writing it is not known which systems, if any, were affected, or whether any data was actually exfiltrated — the group said details would be “published soon.” Deloitte has not confirmed the claim and there is no independent corroboration. Treat this strictly as an unverified leak-site listing until a second source or an official statement appears.