Acronis August 2026 Cyberthreats Update Highlights EY Breach and July Threat Trends
Summary
Acronis’s global update, based on data from more than one million endpoints, covers an EY client-data breach and July 2026 malware and URL detection trends.
Key points
- EY confirmed that an unauthorized party accessed a third-party IT service management platform used by its tax practice from March 28 to April 12, 2026, and downloaded documents belonging to several clients.
- The stolen documents included client tax information and personal and financial information used to prepare tax filings.
- ShinyHunters claimed it obtained credentials through a supply-chain compromise and gained access to EY’s Jira, GitHub and Azure environments; the group threatened to publish the stolen data.
- Acronis reported that 5.6% of its clients had at least one malware threat blocked at the endpoint in July, down from 6% in June and the third consecutive monthly decline.
- Normalized URL detection rates fell month over month across all 16 focus countries; Singapore had the highest rate at 10.2%.
- The July figures were collected through July 29 and may change; the global update draws on data from more than one million endpoints.
Article Details
- Publisher
- Acronis Threat Research Unit
- Report Period
- July 2026; detection figures collected through 2026-07-29
- Scope
- Global endpoint malware and URL threat detections, with a reported data-breach incident.
- Sample Size
- More than one million unique endpoints worldwide.
- Key Statistics
- In July 2026, 5.6% of unique Acronis clients had at least one endpoint malware threat blocked, down from 6.0% in June. July data was collected through 2026-07-29 and may be revised.
- The highest reported normalized malware detection rates in July were Palestine at 42.6%, Vietnam at 30.5%, and Guadeloupe at 26.8% of affected unique clients.
- Normalized URL detection rates declined month over month in all 16 focus markets; the report notes that partial July data collection may contribute to the decline.
- Singapore had the highest July normalized URL detection rate among focus markets at 10.2%, followed by India at 10.0% and the United States at 8.8%.
- Brazil had the largest reported month-over-month decrease in normalized URL detections, from 11.2% in June to 6.7% in July.
- Recommendations
- Enforce multifactor authentication and least-privilege access for vendor and contractor accounts with access to Jira, GitHub, or cloud administrative consoles.
- Monitor ITSM and DevOps platform audit logs for anomalous access.
- Segment sensitive client documents from general-purpose collaboration tooling.
- Use email security and URL filtering to help protect against social engineering threats.
MITRE ATT&CK
Threat Actors
Vendors
Products
Acronis Cyber Protect CloudAcronis Cyber Protect Cloud protects against both known and never-before-seen threats through a multilayered protection approach. This includes behavior-based detection, AI- and ML-trained detections and anti-ransomwareAcronis GenAI Protectionemail security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage,Acronis XDR for Acronis Cyber Protect Cloudand control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR for Acronis Cyber Protect Cloud brings the visibility needed to understand attacks while simplifying the context forAzureobtained credentials through a supply-chain compromise that gave it reach into EY's Jira, GitHub and Azure environments. Confirmed stolen data includes documents containing client tax information, along withGitHubbut instead obtained credentials through a supply-chain compromise that gave it reach into EY's Jira, GitHub and Azure environments. Confirmed stolen data includes documents containing client tax information, alongJiradirectly, but instead obtained credentials through a supply-chain compromise that gave it reach into EY's Jira, GitHub and Azure environments. Confirmed stolen data includes documents containing client tax
Countries
BrazilEvery focus country declined month-over-month in July, but the magnitude varied widely. Brazil recorded the sharpest drop, falling from 11.2% in June to 6.7% in July, down 4.5 percentage points. Italy declined fromCanadahighest level in July at 10.2%, followed by India at 10.0% and the United States at 8.8%. New Zealand and Canada also remained relatively elevated at 8.2% and 8.1%, respectively. Part of this across-the-board softeningColombiato 6.7% in July, down 4.5 percentage points. Italy declined from 10.6% to 7.0% (down 3.6 points), and Colombia eased from 12.9% to 9.4% (down 3.5 points). Canada and the United States each fell by 3.2 points, fromGuadelouperate globally, holding steady at 42.6% of affected unique clients, followed by Vietnam at 30.5%. Guadeloupe entered the top three at 26.8%, displacing Iraq, which fell to fourth at 22.9% after a sharp declineIndiaa lower normalized URL detection rate. Singapore recorded the highest level in July at 10.2%, followed by India at 10.0% and the United States at 8.8%. New Zealand and Canada also remained relatively elevated at 8.2%Iraqunique clients, followed by Vietnam at 30.5%. Guadeloupe entered the top three at 26.8%, displacing Iraq, which fell to fourth at 22.9% after a sharp decline from 31.4% in June.Italyrecorded the sharpest drop, falling from 11.2% in June to 6.7% in July, down 4.5 percentage points. Italy declined from 10.6% to 7.0% (down 3.6 points), and Colombia eased from 12.9% to 9.4% (down 3.5 points).Japanpoints (10.3% to 10.2%, and 6.2% to 6.1%), making them the most stable markets in the set. New Zealand, Japan and the United Kingdom also declined more modestly than the group average, each falling roughly 1.6 to 2.1Mexicothe United States each fell by 3.2 points, from 11.3% to 8.1% and from 12.0% to 8.8% respectively, while Mexico dropped from 11.1% to 7.8%.New Zealandrecorded the highest level in July at 10.2%, followed by India at 10.0% and the United States at 8.8%. New Zealand and Canada also remained relatively elevated at 8.2% and 8.1%, respectively. Part of thisPalestineJuly, the top three countries with the highest malware detection rates shifted compared with June. Palestine again recorded the highest rate globally, holding steady at 42.6% of affected unique clients, followedSingaporecompared with June, with every one of the 16 markets recording a lower normalized URL detection rate. Singapore recorded the highest level in July at 10.2%, followed by India at 10.0% and the United States at 8.8%.South KoreaBy contrast, Singapore and South Korea were essentially flat, each slipping only 0.1 percentage points (10.3% to 10.2%, and 6.2% to 6.1%), making them the most stable markets in the set. New Zealand, Japan and theUnited Kingdom10.2%, and 6.2% to 6.1%), making them the most stable markets in the set. New Zealand, Japan and the United Kingdom also declined more modestly than the group average, each falling roughly 1.6 to 2.1 percentage points.United Statesrate. Singapore recorded the highest level in July at 10.2%, followed by India at 10.0% and the United States at 8.8%. New Zealand and Canada also remained relatively elevated at 8.2% and 8.1%, respectively. PartVietnamrecorded the highest rate globally, holding steady at 42.6% of affected unique clients, followed by Vietnam at 30.5%. Guadeloupe entered the top three at 26.8%, displacing Iraq, which fell to fourth at 22.9% after