Feds charge former Accenture employee for misleading them on cloud security
A former product manager at Accenture repeatedly lied to the company’s government customers about the compliance of its cloud product with security regulations. Now, she’s been charged by the Justice Department.
According to the department, Hillmer, a former senior manager, specifically lied about a product’s compliance with Department of Defense requirements and concealed the fact that Accenture’s cloud platform didn’t actually implement the required security controls.
The indictment states that Hillmer, 53, was engaged in this type of criminal activity between March 2020 and November 2021. Not only was she herself concealing security issues from auditors, but the defendant was also instructing others to do the same.
More specifically, Hillmer allegedly hid the fact that her employer’s platform did not comply with the Federal Risk and Authorization Management Program (FedRAMP) and the Department of Defense’s Risk Management Framework.
FedRAMP is the US government framework for assessing and monitoring the security of private sector cloud services used by federal agencies.
Misrepresenting a system’s security to the government can be dangerous for an agency’s cyber posture because the compliance check helps determine if a product is safe to operate in federal environments.
According to the indictment, Hillmer falsely represented that the Accenture cloud platform for federal use had implemented the required access controls, logging, monitoring, and other security capabilities. All this despite repeated warnings that the system lacked these.
Additionally, Hillmer allegedly made false and misleading representations to the US Army to induce it to sponsor the platform for a Department of Defense provisional authorization.
The charges appear to align with the activity the firm mentioned in an SEC filing in 2023, after Accenture Federal Services (AFS) made a voluntary disclosure to the US government.
The disclosure, it said, resulted in an investigation “concerning whether one or more employees provided inaccurate submissions to an assessor who was evaluating on behalf of the US government an AFS service offering and whether the service offering fully implemented required federal security controls.”
Hillmer – who was most recently employed at SentinelOne, another cybersecurity company – was charged with wire fraud, major government fraud, and obstruction of a federal audit. If found guilty, she faces decades in prison.
“As previously disclosed in our public filings, we proactively brought this matter to the government’s attention following an internal review. We have cooperated extensively with the government’s investigation and continue to do so,” said an Accenture spokesperson.
Unlock more exclusive Cybernews content on YouTube.
